Cookie Notice

Two cookies, both strictly necessary, and why there is no consent banner to click.

Cookie Notice

MOHAMMAD SAMAD LLC, trading as REWARDED · Last updated: 2026-09-28

There is no cookie banner, and that is deliberate

You will not be asked to accept cookies on app.rewarded.agency, because there is nothing to accept. The portal sets two cookies, both of them strictly necessary to sign you in and keep you signed in. Under UK and EU law, strictly necessary cookies do not require consent — so a banner asking for it would be theatre, and clicking it would change nothing.

We run no analytics, no advertising, no tracking pixels and no third-party cookies in the portal.

The two cookies

Name	What it holds	How long	Why
`rw_session`	A random session token. Not your email, not your name, no readable information about you — the server holds only a one-way hash of it	60 days, or until you sign out	Without it you would have to request a new code on every page
`rw_pending`	The email address you just typed, while you go and fetch the code from your inbox	20 minutes	So the code entry page knows which address the code was sent to. It expires with the code

Both are set with:

HttpOnly — JavaScript on the page cannot read them, which is what stops a cross-site scripting bug from stealing your session
SameSite=Lax — they are not sent when another site makes a request on your behalf
Secure — sent only over HTTPS in production

Signing out deletes both and revokes the session on the server, so a copied cookie stops working. You can also clear them in your browser at any time; the only consequence is that you sign in again.

What this is not

We do not use cookies to:

Track you across other websites
Build an advertising profile
Measure how you use the portal
Share anything with a third party

There is no "reject all" button because there is nothing in the "all".

The marketing site

rewarded.agency is a separate site on separate infrastructure, and it sets no cookies at all. It loads no analytics, no advertising and no tracking script. Netlify, which hosts it, keeps standard server logs for security and abuse prevention; that is not a cookie and does not identify you personally.

If we ever add analytics to the marketing site, this notice will name the tool, and we will add a real consent banner rather than a fake one.

Questions

samadmohammad606@gmail.com. Full detail of everything we hold is in the Privacy Policy.