Cookies and local storage
Revision: 2026-10-24 · Version: 1.2
1. What we use
Session cookie — keeps you signed in after wallet login. Without it you would have to sign a login on
every page. Lifetime: until the session ends or you sign out.
Guest device cookie (xpf_dev) — a random identifier with our signature, set when you open the
terminal. It lets us count live Radar boards per device for visitors who have not signed in: up to 2 per
device and up to 8 per internet address in total, so a phone and a computer on one home network do not
take each other's place, and one visitor cannot take all the places. It holds no wallet, account, address
or time, is not linked to signing in, and is not used for analytics or advertising. Your internet address
is used for the same count only in the server's memory, while boards are open and for a few minutes after. Without this cookie Radar
still works, but guest boards opened without it from your address share one limit of 2. Lifetime: 400 days.
Interface cookie (bx_ui) — a token with our signature that lets the pages of the terminal load their
data from our server; without it the pages stay empty. It holds nothing but its own expiry time — no wallet,
account or address — and page scripts cannot read it. Lifetime: 24 hours.
Language cookie (bony_lang) — remembers the interface language you chose, so that the server sends the
page in that language right away instead of switching it after loading. It holds only the language code.
Lifetime: 365 days.
Your analytics choice — when you answer the usage-analytics question, we remember the answer
("allowed" or "declined", nothing else) in the cookie bonyx_analytics_v1 and in a copy in local storage,
so that the page knows your choice before it counts anything. Lifetime: 365 days or until you change your
choice.
Referral source — if you open X PrimeFlow through a link with an invitation code or a campaign tag, we
keep that tag in the cookie bx_src so that the invitation is credited to the person who invited you. It is
set only for such links and only once (the first link wins), page scripts cannot read it, and it lives
90 days.
Browser local storage — keeps your settings in your own browser and is never sent to our server:
- selected interface language;
- which Academy articles you have read, to show your progress;
- an invitation code from a link you opened, until you sign in (at most 90 days), so that the invitation is
not lost on the way;
- selected exchanges, pairs and panel settings;
- the encrypted vault with exchange keys — ciphertext only; the master password is stored nowhere and
lives only in the tab's memory;
- switch states (for example live trading, which is off by default).
2. Usage analytics — only with your consent
We set no advertising cookies, use no third-party trackers and pass your activity to no ad platforms.
Usage analytics is off until you agree. We ask once, in a banner. If you allow it, we record which sections
you open and on which day (UTC), linked to your account — no time of day, no page address, no IP address,
no wallet address, no third-party counters. Visitors who are not signed in are not recorded at all. Records
are kept for 90 days and then deleted.
If you decline or simply do not answer, nothing is recorded.
3. How to control it
You can change your analytics choice at any time in your account (Usage analytics → Revoke consent or Allow).
Revoking stops new records at once; what was already counted stays until its 90 days run out.
You can clear cookies and local storage in your browser settings. Consequences: you will have to sign in
again, panel settings reset,
and the encrypted vault with exchange keys is deleted along with the browser data — the keys will have to be added again.
Blocking strictly necessary cookies makes signing in impossible.