Cookie Policy | Romarket

On this page

Last Updated: October 26, 2026 | Version: 1.3

About This Policy

This Cookie Policy explains how Romarket uses cookies and similar storage technologies when you visit our website. It describes what these technologies are, why we use them, and your options for controlling them.

What Are Cookies#

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember your preferences, and provide information to site owners.

Cookies can be:

Session cookies: Deleted when you close your browser
Persistent cookies: Remain on your device until they expire or you delete them

Cookies We Use#

Essential Cookies#

Required for the website to function

These cookies support sign-in and your privacy choices. You can block or delete them in your browser, but sign-in or saved preferences may stop working:

Cookie	Purpose	Duration
`better-auth.session_token`	Maintains your authenticated session	Normally 7 days; refreshed during use. A non-remembered session uses a session cookie
`better-auth.state`	Protects a Roblox sign-in or account-linking attempt	10 minutes; removed after the callback
`better-auth.dont_remember`	Remembers a request to use a session-only sign-in	Browser session
`c15t`	Remembers your consent choices; also stored in localStorage	Cookie normally up to 1 year; the choice may need renewal sooner

Authentication cookies may have the __Secure- prefix on HTTPS. They are HTTP-only. Consent storage can also include c15t-* support records and older privacy-consent-storage records; browser storage has no automatic deletion timer.

Analytics Cookies#

Help us understand how you use our site

We use PostHog for privacy-focused analytics:

Cookie	Purpose	Duration
`ph__posthog` and related `ph_` records	PostHog identifiers and analytics state, using cookies, localStorage and sessionStorage	Cookies normally up to 1 year; browser storage persists until cleared, replaced or removed by the SDK

PostHog helps us understand:

Which pages are visited most frequently
How users navigate through the platform
Where users encounter errors
General usage patterns

PostHog loads only after marketing consent. It can record anonymous events with an anonymous distinct identifier, but person_profiles: "identified_only" prevents PostHog from creating a person profile unless the user is identified.

Advertising Cookies#

Measure whether our ads work

We use the TikTok Pixel to measure the results of our TikTok advertising:

Cookie	Purpose	Duration
`_ttp`	TikTok identifier used to match your visit to an ad you saw	13 months

The pixel loads only after marketing consent and reports actions such as viewing a listing, searching, saving a listing, contacting a seller, creating an account, and completing a purchase.

These events are also sent from our server through TikTok's Events API, carrying the same information plus your IP address and browser user agent. Both copies share one event identifier so TikTok counts the action once. If you are signed in, your email address and account identifier are irreversibly hashed (SHA-256) before they are sent -- TikTok receives the hash, never the address itself. Nothing is sent from the browser or the server without marketing consent.

Local Storage#

We also use browser localStorage (not cookies) for:

Key	Purpose	Cleared
`theme`	Remembers your light, dark or system theme choice	When replaced or you clear site data
`c15t` and related records	Remembers your consent choices and supports consent updates across tabs	When replaced or you clear site data; expired consent must be renewed
`listing-draft-new-listing`	Saves your new-listing form, screenshot references and current step on this browser	After successful submission, Discard or Clear form, or when you clear site data; no automatic expiry
`romarket:escrow-creation-uncertainty:v1:*`	Remembers an unresolved escrow creation attempt for an account and deal, using IDs only, so reloads and other tabs can show the warning	When the attempt is resolved, or you clear site data; no automatic expiry
`rmkt:browser-notifications-off`	Remembers that browser notifications are off on this device	When you turn them back on or clear site data
`rmkt:browser-notifications-prompt-dismissed`	Remembers dismissal of the browser notification prompt	When you clear site data
`romarket_ttclid_v1`	Stores a TikTok ad click identifier after marketing consent	Stops being used after 30 days; the stored record remains until replaced, marketing consent is withdrawn or you clear site data
`romarket_signup_reported_v1:*`	Prevents repeated signup reporting attempts on reload; the marker can be set even when optional tracking is off	When you clear site data
`rmkt_growth_active_day`	Prevents counting a signed-in account's activity more than once per UTC day, after marketing consent	Replaced on the next counted account/day, or when you clear site data
`rmkt:email-verification-reminder:*`	Remembers email reminder timing for an account: a 3-hour snooze, a 30-minute gap between tabs and a 24-hour quiet period after taking action	Timing expires, but the record remains until replaced or you clear site data

Local listing drafts belong to this browser, not an account. On a shared device, discard or clear a draft when you finish.

Session Storage#

We use browser sessionStorage for:

Key	Purpose	Cleared
`romarket_acquisition_v1`	First-touch attribution, only after you grant marketing consent: remembers the consented acquisition channel, landing path, referrer hostname, and campaign fields for the current session	When the browser session ends or marketing consent is withdrawn
`rmkt:email-verification-reminder-seen:*`	Records that the email reminder was already shown in this visit, so it appears once per visit	When the browser session ends
`romarket:pending-listing-save`	Remembers your explicit Save action while you sign in, using a listing ID, random identifier and expiry	Consumed once; expires after 30 minutes and is removed when checked, or when the tab session ends
`rmkt:chunk-reload-at`	Prevents repeated automatic reloads after a failed app download	The 1-minute guard expires, but its timestamp remains until replaced or the tab session ends

The attribution record stores the referring hostname, not the full external referring URL. Session storage is normally specific to a tab; browsers may restore it when restoring a session.

Browser History and Memory#

Browse uses a small history.state record, rmktBrowseReturnPosition, to return you to the listing you opened. It contains public listing IDs, the number of cards shown, scroll position and random identifiers. It does not contain private listing figures or an account ID. It belongs to that browser history entry and is used only when the current results and account context still match. Reloading starts a new account context for this feature.

The app also holds temporary form state and fetched data in page memory. Before a marketing consent decision, the landing URL and referrer can be held in memory; consented attribution saves only the allowed fields described above. Page memory is normally released on a full reload or when the tab closes.

If you enable browser notifications, the browser also manages notification permission, a push subscription and a service worker. Turn notifications off in your account settings or your browser's site settings. The service worker does not cache pages or listing data for offline browsing.

Third-Party Services#

PostHog#

We use PostHog for product analytics. They:

Process data in compliance with GDPR
Do not sell user data to third parties
Provide privacy-focused analytics

Learn more: PostHog Privacy Policy

TikTok#

We use the TikTok Pixel and TikTok's Events API to measure our advertising. TikTok receives the events described above, along with hashed identifiers when you are signed in, and may use them to attribute conversions and improve ad delivery.

Learn more: TikTok Privacy Policy

Roblox OAuth#

When you sign in with Roblox, Roblox may set their own cookies during the OAuth flow. See Roblox's Privacy Policy.

Escrow.com#

During payment processing, Escrow.com may set their own cookies. See their privacy policy for details.

Managing Cookies#

Use Cookie Settings in the footer to review or withdraw optional consent. PostHog analytics and TikTok advertising use the Marketing category. Blocking a cookie in browser settings alone does not withdraw a consent choice already saved in localStorage.

Browser Settings#

Control cookies through your browser:

Chrome: Settings → Privacy and security → Cookies
Firefox: Settings → Privacy & Security → Cookies
Safari: Preferences → Privacy → Manage Website Data
Edge: Settings → Privacy, search, and services → Cookies

Clearing Site Data#

Clearing cookies can sign you out. Clearing browser storage can remove an unfinished listing draft, theme, consent choice, saved-action continuation and dismissed reminders. It does not delete submitted listings, saved listings, messages or deals held in your account. Browse history and browser notification permissions are managed separately by your browser.

Clearing storage can also remove an unresolved escrow warning. It does not cancel or confirm an escrow attempt. If an attempt was uncertain, check the existing deal and ask support before starting another one. The local marker is a recovery aid, not a guarantee against duplicate provider transactions.