Cookie Policy
Last updated 10/10/26
1. What this policy covers
This policy is issued by GigaTech Niugini Limited (company no. 1-148489106), trading as Bidligence. It covers the Bidligence website and app at bidligence.com and explains the cookies and similar browser storage (localStorage and sessionStorage) they use. It sits alongside the Privacy Policy, which explains what personal data we process and your rights.
A cookie is a small file a website asks your browser to keep and send back on later visits. localStorage keeps data in your browser until it is deleted; sessionStorage keeps it only until you close the tab.
2. Your choice
The first time you visit, a banner asks what Bidligence may keep on your device. There are two kinds. Strictly necessary cookies and storage are needed for something you have asked for — staying signed in, protecting your account, paying — and are always on; the law allows these without consent. Preference storage remembers interface choices on your device; it is used only if you allow it.
Choose "Accept all", "Necessary only", or "Choose which cookies" to decide yourself; nothing optional is switched on before you choose. You can change your mind at any time from Cookie settings in the footer of the website and in the app under Settings → Your profile & alerts. Your answer is kept in the hf_consent cookie for 6 months, after which we ask again. If you decline preferences, your choices last only until you close the tab, and anything Bidligence had already remembered on this device is removed. One choice is different: a language you pick while signed in is a setting of your account, saved with it whatever you choose here, so it follows you to other devices (Privacy Policy §9).
3. Strictly necessary cookies
Set by Bidligence on bidligence.com. The names are the ones your browser shows; the __Secure- and __Host- prefixes mean the cookie is only ever sent over an encrypted connection.
| Cookie | What it does | How long it lasts |
|---|---|---|
| __Secure-authjs.session-token | Keeps you signed in: an encrypted token holding your account, workspace and role. | Ends after 14 days without use, and at the latest 30 days after you signed in. |
| __Host-authjs.csrf-token | Protects signing in and out against cross-site request forgery. Set on your first visit, signed in or not. | Until you close your browser. |
| __Secure-authjs.callback-url | Remembers which page to return you to after signing in. Set on your first visit. | Until you close your browser. |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce | One-time security checks while you sign in with Google, GitHub or Apple. | 15 minutes; deleted when the sign-in completes. |
| __Host-hf_2fa | Carries a sign-in from your password to your two-factor code (only if you have turned two-factor sign-in on). | 5 minutes; deleted when the sign-in completes. |
| hf_kd | Recognises a browser you have signed in from before, so our protection against password-guessing on your account never locks you out. It holds only keyed codes — never your e-mail, password or address. | 1 year, renewed each time you sign in. |
| hf_ref | Carries a referral code through a Google, GitHub or Apple sign-up so the referral is credited. Set only when you press one of those sign-up buttons after following a referral link. | 1 hour; deleted once your account is created. |
| hf_consent | Remembers your answer to the cookie banner. | 6 months. |
| __Host-hf-admin | Keeps a Bidligence staff member's verified session in our internal console. Never set for customers. | 12 hours at most; ends after 30 minutes without use. |
4. Strictly necessary browser storage
Kept by Bidligence in your browser to carry something you typed through signing in.
| Name | Where | What it does | How long it lasts |
|---|---|---|---|
| hf-hunter-draft | localStorage | A message you typed to Hunter 1.0 on the homepage before signing in, so it is waiting for you once you have signed up or signed in. | 2 hours; also deleted when you sign in elsewhere in Bidligence or sign out. |
| hf-hunter-handoff | sessionStorage | Passes a message you typed to Hunter 1.0 to the Hunter page in the same tab. | Until it is read, and at most 2 hours; this tab only. |
5. Preference storage (only with your consent)
With your consent these are kept in localStorage until you clear them or withdraw consent. Without it, Bidligence's own preferences are kept in sessionStorage for this tab only, and the Autodesk Viewer's are deleted each time a page loads. (A language picked while signed in is also saved with your account, as section 2 explains.)
| Name | Set by | What it remembers |
|---|---|---|
| theme | Bidligence | Light or dark theme. |
| hf_lang, hf_lang_decided | Bidligence | The language you read Bidligence in, and that you have answered the offer to translate it. |
| huntflow.3d-look | Bidligence | The look you last chose for the 3D view, so the picker can mark it "Last used". |
| Autodesk.Viewing.Preferences.* | Autodesk Viewer | The viewer's own settings, such as lighting, when you open a DWG sheet in it. |
6. Third parties
Paddle, our merchant of record, runs the checkout. On pages where you can pay, Paddle's script (Paddle.js) and Paddle's ProfitWell script, used for Paddle Retain, load into the page; in our own checks they stored nothing on bidligence.com for a visitor who was not paying. The checkout itself opens in a Paddle frame, which sets Paddle's own cookies under Paddle's cookie policy.
Cloudflare Turnstile runs the bot check on the sign-up, e-mailed sign-in link, password-reset and contact forms. In our own checks it stored nothing on bidligence.com; its frame, on challenges.cloudflare.com, may set Cloudflare's own cookies for the check, under Cloudflare's policy.
If you sign in with Google, GitHub or Apple, you leave Bidligence for their page, where they set their own cookies under their own policies.
The Autodesk Viewer, used to open DWG sheets, loads from Autodesk. It collects usage analytics for Autodesk by default; Bidligence switches that off. Its preference storage is listed above.
Bidligence's fonts are served from bidligence.com itself, so no request goes to Google Fonts. We use no advertising or analytics cookies and no tracking pixels.
7. Blocking or deleting cookies
You can block or delete cookies and site data in your browser's settings at any time. If you block strictly necessary cookies, signing in and paying will not work. Deleting Bidligence's site data signs you out and clears your cookie choice, so the banner asks again.
8. Changes and contact
When the cookies or storage Bidligence uses change, we update this policy and the date at the top of it; a change to the kinds of storage we ask your consent for will ask you again. Questions: privacy@bidligence.com.