1. What this policy covers
This policy describes every cookie set by Telesuber — on our website at
https://telesuber.com, in the dashboard, and on the checkout pages we host for creators at
https://telesuber.com/buy/ and their sub-pages. It names each cookie, says what it is for and how
long it lasts. No script on the page can read any of them. It also names the cookies Stripe
sets on the one page of ours where Stripe’s script runs, in section 5.
It sits alongside our Privacy Policy, which explains everything else
we do with personal information, and the rest of our legal pages at
/legal.
2. What a cookie is
A cookie is a small piece of text that a website asks your browser to keep and to send back
on the next request. Because the web is otherwise forgetful — each request arrives
knowing nothing about the one before it — a cookie is how a site can tell that two
requests came from the same browser.
That is all a cookie is. It cannot read your files, see other sites you visit, or run
anything on your computer. What matters is not the cookie itself but what a site chooses to
put in one and how long it keeps it, which is what this policy sets out.
A few terms used below:
- A first-party cookie is set by the site you are actually on. All of
ours are first-party: every cookie we set belongs to our own domain. One other company sets
cookies through one of our pages — Stripe, on the card step of our own checkout, as
section 5 explains — and on no other page does anybody but us.
- A session cookie is deleted when you close your browser; a
persistent cookie has an expiry date. Each of ours has one, listed in
section 4. Most last minutes or hours; the longest, 180 days, is the one that recognises a
browser you have signed in from before.
- A strictly necessary cookie is one without which something you asked
for cannot be delivered — signing in, for example, or submitting a form safely.
3. Why there is no cookie banner
Under EU and UK rules, a site must obtain consent before storing cookies on your device
unless they are strictly necessary to provide a service you have asked for. Consent
is what a cookie banner exists to collect.
Every cookie we set is strictly necessary, so there is nothing for you to consent to and
nothing for you to refuse without also refusing the thing the cookie does. Showing you a
banner would be asking a question with only one useful answer, so we do not show one.
Stripe’s cookies on the card step of our checkout are strictly necessary in the same
sense: they exist to tell a genuine card payment from a stolen card being tried, and they
are set only on the page where you have chosen to pay by card.
If we ever wanted to set a cookie that was not strictly necessary, we would ask you first,
and it would be genuinely optional.
If you have never signed in and never started a purchase, you will usually have no
cookies from us at all. Reading the home page, pricing, how to start or the blog sets
nothing. The first cookie appears only when you open a sign-in, sign-up or password form
— that is the form-security cookie in the table below — or, on a creator's
checkout page, when a buyer goes on to pay or chooses “Continue with
Telegram”.
4. The cookies we set
This is the complete list of the cookies we set. There are no others. The cookies Stripe
sets on one page of ours are not ours, and are listed separately in section 5.
4.1 Signing in and using your account
| Name |
Purpose |
Lifetime |
| tgsubs_session |
Keeps you signed in, so that you are not asked for your password on every page |
12 hours |
| tgsubs_csrf |
Proves that a form was sent from one of our own pages, which protects you against
cross-site request forgery — another site submitting a form as you. It holds a
random value and nothing about you. Its life starts again with each page you open |
12 hours |
| tgsubs_2fa |
Holds the step between your password and your two-step verification code |
5 minutes |
| browser |
Recognises a browser you have signed in from before, so that somebody guessing at
your password somewhere else cannot lock you out of it. It holds a random value, and it
stays when you sign out, because that is when it matters. Its life starts again each
time you sign in there |
180 days |
| browser_fresh |
Marks that the cookie above has just been given a new value, so that the next
page can confirm it arrived. Usually gone on the next page |
Up to 1 day |
| hello |
Shows a one-time welcome message after you sign in or sign up |
30 minutes |
| tgsubs_signup |
Links this browser to your unfinished sign-up, so that you can close the tab and
pick up where you left off. It is forgotten as soon as anybody signs in or out in this
browser. Until then, anybody who opens sign-up in this browser sees the name and
address you typed, with a way to start again — so on a shared computer, press
“Start again” before you leave. The link in a reminder email still brings
you back |
7 days |
| tg_connect |
Holds the one-time link that connects your Telegram channel or group while you set
it up |
25 minutes |
| paying |
Remembers, when you start paying for your plan with us, which payments this
browser started, and once you have paid, that it is still being confirmed, so that
nothing offers to take it a second time until it is. For each, it holds the
workspace, the plan, a one-off word for that payment and a mark of the subscription
you had before it. A payment started is forgotten after a day; one you have paid is
forgotten once it is confirmed, or an hour after you last looked |
1 day |
4.2 Carrying a message to the next page
These hold a sentence or a link for the page that comes straight after the one you were
on, and are spent by it.
| Name |
Purpose |
Lifetime |
| said |
Carries a short message, such as “Saved”, from the page where you did
something to the page that follows it, once |
2 minutes |
| invite_link |
Shows a team invitation link once, when it could not be emailed, so that you can
copy it and send it yourself |
2 minutes |
| invite_sent |
Says, once, which address a team invitation was just emailed to |
2 minutes |
| staff_invite_link |
The same as invite_link, for an invitation to the team that runs
Telesuber |
2 minutes |
| staff_invite_sent |
The same as invite_sent, for that team |
2 minutes |
4.3 Buying on a creator's checkout page
| Name |
Purpose |
Lifetime |
| claim |
Holds the keys to what a buyer has bought in this browser on a creator's checkout
pages, so that the receipt, and the button that
gives them access, still work when they come back |
30 days |
| tgsubs_tg |
Remembers a buyer's Telegram identity, exactly as signed by Telegram, on a
creator's checkout pages |
1 hour |
The cookies in 4.1 and 4.2 appear only once you start signing in, signing up or using the
dashboard. Those in 4.3 appear on a creator's checkout page, and only when a buyer goes on to
pay or chooses to continue with Telegram. tgsubs_tg holds the identity
Telegram itself signed, and the Service re-checks that signature every time it reads the
cookie, so a value tampered with or minted elsewhere is refused.
5. Stripe’s cookies on the card step
A workspace paying us for its own plan by card may type the card on the card step of our
own checkout, into Stripe’s card fields shown on our page. That step is the one page
of ours that runs another company’s script — Stripe’s, from js.stripe.com
— so that the card number goes straight from your browser to Stripe and never reaches
us. Stripe’s script sets these cookies on our domain there:
| Name |
Purpose |
Lifetime |
| __stripe_mid |
Stripe’s fraud-prevention cookie: lets Stripe recognise this browser, so it can
judge the risk of a card payment attempted from it |
1 year |
| __stripe_sid |
Stripe’s fraud-prevention cookie: lets Stripe recognise this visit, for the
same purpose |
30 minutes |
They are Stripe’s fraud-prevention cookies, and they are set only on the card step
of our own checkout: not on any other page of ours, not on a creator’s checkout page,
and not at all for anybody who never opens that step. Once set, they stay in your browser
for the lifetime above, like any cookie, unless you delete them. Stripe sets and reads
them, and Stripe says it does not use what it learns this way for advertising; their
lifetimes and what Stripe does with them are Stripe’s to set, and are described in
Stripe’s own cookie and privacy policies. Your browser sends them to our server along
with our own, as it sends every cookie of a site; nothing here reads or keeps them.
Where a card is taken on Stripe’s own page instead (section 8), Stripe sets its
cookies there, on its own domain, and none on ours.
6. How our cookies are protected
On the live service every cookie in section 4 carries the same protections:
- Its name carries the __Host- prefix — for example
__Host-tgsubs_session. A browser will only accept a cookie with that
prefix if it is bound to this exact host and sent over HTTPS, and it refuses to let any
other host set one. It is what stops a neighbouring site planting a cookie for us.
- It is marked Secure, so the browser sends it over HTTPS and never over
an unencrypted connection.
- It is marked SameSite=Lax, so it is not sent along with requests
triggered from other websites.
- It is marked HttpOnly, which puts it out of reach of any script on the
page — the form-security one included, since the form carries its own copy of that
value.
All of them are set on our own domain only. Apart from Stripe’s on the card step,
which Stripe’s script sets with its own settings rather than these (section 5), no
other company sets, reads or receives a cookie through our pages.
7. What we do not use
To be specific rather than reassuring:
- No analytics cookies. We use no analytics product of any kind, so we
cannot tell you how many people read a page, and we do not measure your journey through
the site.
- No advertising or marketing cookies, no retargeting, no conversion
pixels, no advertising networks. We do not advertise to you anywhere.
- No social media cookies, buttons or embeds.
- No third-party cookies, but for Stripe’s on the card step. Our
pages load no third-party fonts and no embedded content, and no third-party scripts with
one exception: the card step of our own checkout loads Stripe’s script, so that a
card is typed into Stripe’s own fields and goes straight to Stripe. That script sets
the fraud-prevention cookies in section 5. This is enforced by a strict content security
policy, not merely by intention: every other page refuses any script that is not ours,
and that one page allows Stripe’s and ours and nothing else.
- No tracking pixels on our pages or in our emails. Our emails contain no
images that report back, which means we cannot tell whether an email we sent you was
opened.
- No fingerprinting. We do not build an identifier out of your browser,
fonts, screen or device characteristics, and we do not use any technique intended to
recognise you without a cookie. Stripe’s script on the card step does look at the
browser and the device, and at how its card fields are used, to tell a real payer from a
stolen card — that is what it is there for, it runs on that page alone, and Stripe
describes it in its own privacy policy.
- No local storage or session storage. The Service keeps nothing in your
browser's storage areas — the cookies in section 4 are the whole of what we store on
your device.
Our web server does keep ordinary logs of the requests it receives, which is a separate
thing from a cookie and is described in the Privacy Policy.
8. Other sites you may pass through
Two steps in the product hand you over to another company's website. Those are their sites,
with their own cookies, their own policies and their own choices — we cannot set,
read or control what happens there, and this policy does not cover it.
- Telegram's login window at oauth.telegram.org, if a buyer chooses
“Continue with Telegram” on a checkout page, or if you use Telegram to sign
in. What comes back to us is the signed identity described in section 4.
- Payment providers' hosted checkout pages — Stripe, PayPal,
Skrill or NOWPayments. Card details are typed there, on their page, and never reach us. Which
provider you see depends on the creator you are buying from, or on how you are paying us
for your own plan. When you pay us for your own plan by card, the card may instead be
typed into Stripe’s fields on the card step of our own checkout (section 5): it
still goes straight to Stripe and never reaches us.
- A payment through OKX is the one that passes through no other site:
the page that shows the seller’s OKX deposit address and the amount is ours, sets
no cookie of a payment provider, and sends nothing about you to OKX. What you do in your
own wallet or OKX account is covered by their policies, not this one.
If you want to know what those companies store on your device, their own cookie and privacy
policies are the place to look.
9. Blocking or deleting cookies
You are in control of your browser, and you can clear or block cookies whenever you like.
Every major browser offers this in its settings, usually under a heading such as Privacy,
Content settings or Site data, where you can delete cookies already stored, block them for a
particular site, or block them all. The Help menu in your browser will give you the exact
steps for the version you are running.
Because everything we set is strictly necessary, blocking or deleting our cookies does not
reduce tracking — there is none — but it does stop parts of the Service working:
- You will not be able to sign in. Without the session cookie the Service
cannot tell one page request from another, so it will return you to the sign-in page every
time.
- Forms will be refused. Without the form-security cookie a submission
cannot be shown to have come from our own page, so it is rejected — including
signing in, signing up and resetting a password.
- Two-step verification cannot complete, because the step between your
password and your code has nowhere to live.
- An unfinished sign-up cannot be resumed in that browser, though the link
in a reminder email still brings it back.
- Your browser is not recognised as one you have signed in from, so if
somebody has been guessing at your password you may be asked to wait, or to reset it.
- A buyer's receipt cannot be opened again in that browser. The creator can
still see the payment and let them in by hand.
- “Continue with Telegram” on a checkout page will not be
remembered, and a buyer will have to identify themselves another way.
Deleting the cookies after you have finished is entirely safe: the worst that happens is
that you are signed out. You can also use your browser's private or incognito mode, which
discards them when you close the window.
10. Changes to this policy
If we add, remove or change a cookie, we will update the tables in sections 4 and 5 and the date at
the top of this page. If we ever introduced a cookie that was not strictly necessary, we
would ask for your consent before setting it rather than announce it here after the
fact.