Cookie Policy

This Cookie Policy explains how MyTripMatch uses cookies and similar browser storage technologies when you visit our website or use our mobile app.

1. What Are Cookies and Local Storage?

Cookies are small text files placed on your device by a website. Local storage is a similar browser technology that stores data on your device without an automatic expiry date. We primarily use local storage rather than traditional cookies to keep our platform functional.

2. What We Store and Why

2.1 Essential — Authentication Tokens

We store JSON Web Tokens (JWTs) in your browser's local storage to keep you logged in across page visits. Separate tokens are used for user accounts, agent accounts, and admin accounts — they do not interfere with each other. These tokens expire automatically after 7 days.

We also store your cookie choice (whether you accepted preference storage) so we do not ask again on every visit.

These are strictly necessary for the Platform to work. Without them, you would need to log in on every page visit. They cannot be disabled while you remain logged in.

2.2 Preferences

• Theme preference — stores your dark/light mode selection
• Language preference — stores whether you selected Hindi or English
• Notifications — if you turn on browser notifications, your browser keeps a push subscription so we can send them; you can turn this off at any time in your browser settings

2.3 Third-Party Storage (Razorpay)

During the payment checkout process, Razorpay may set its own cookies and local storage entries to detect fraud and process your payment securely. We have no control over these. Please see Razorpay's Privacy Policy for details.

3. What We Do Not Use

• We do not use advertising cookies or cross-site tracking pixels
• We do not use Google Analytics or any third-party analytics cookies (our pages do load fonts from Google Fonts, which receives your IP address but sets no cookies — see our Privacy Policy)
• We do not sell or share cookie/storage data with advertisers
• We do not use persistent cross-site tracking of any kind

4. Security Headers We Set

In addition to local storage, our server sets the following HTTP headers on every response to protect you — these are not cookies but they are part of how we secure your browsing experience on MyTripMatch:

• Content Security Policy (CSP) — restricts which scripts, styles, and connections our pages can make, preventing cross-site scripting (XSS) attacks
• Strict-Transport-Security (HSTS) — forces your browser to always use HTTPS when connecting to MyTripMatch, preventing man-in-the-middle attacks
• X-Frame-Options: DENY — prevents MyTripMatch pages from being embedded in iframes on other sites (clickjacking protection)
• X-Content-Type-Options: nosniff — prevents browsers from misinterpreting file types
• Referrer-Policy — controls what information is shared with external sites you navigate to from MyTripMatch

5. Mobile App

Our mobile app (planned) will use equivalent secure token storage provided by the mobile operating system (iOS Keychain / Android Keystore) rather than browser local storage. The same principles apply — only what is strictly necessary is stored.

6. Managing Your Storage

You can clear cookies and local storage at any time via your browser settings (Settings → Privacy → Clear browsing data). Doing so will log you out of MyTripMatch and reset your saved preferences. You can also use your browser's developer tools to inspect exactly what MyTripMatch has stored in your browser.

7. Changes to This Policy

If we start using new storage technologies or change how we use existing ones, we will update this page and revise the "Last updated" date. Material changes will also be communicated via in-app notice.

8. Contact Us

Questions about this Cookie Policy? Write to us at support@mytripmatch.in.