Cookie Policy
Last updated: 17 September 2026 · Version 1.1
1. In short
The Moto Buyback website sets only strictly necessary cookies: two signed session cookies that keep you signed in to your rider dashboard (they carry a signed token, not your personal details). We set no advertising, analytics or tracking cookies, we load no third-party tracking scripts, and nothing on this site follows you across other websites. Two third-party services are contacted while you browse — the flag-image CDN and our error-monitoring provider — and section 5 says what each receives.
Because none of these are optional, we do not ask you to opt in — the law does not require consent for cookies that are needed to provide a service you asked for. We show a short notice on your first visit so you know what is set, and this page explains it in full.
2. What cookies are
A cookie is a small text file a website stores in your browser so it can recognise you on your next request — for example, so you stay signed in as you move between pages. Modern browsers also offer local storage and session storage, which work in a similar way but are only ever read by this website, never sent to a server. We list both below, because both hold information on your device.
3. Cookies we set
Both cookies are set by our API only when you sign in, are marked httpOnly (no script on the page can read them), Secure (sent over HTTPS only) and SameSite (not sent with requests from other sites). They are removed when you sign out.
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
| access_token | Identifies your signed-in session on each request to the API. | 15 minutes, renewed silently while you use the site | Strictly necessary |
| refresh_token | Lets the site renew your session without asking you to sign in again. Scoped to the sign-in endpoints only. | 7 days from sign-in (or until you sign out or end the session from your dashboard) | Strictly necessary |
4. Browser storage we use
These values stay in your browser and are never sent to us. They hold no personal information — no names, email addresses or tokens.
| Key | Purpose | Lifetime | Type |
|---|---|---|---|
| mbb-auth-hint | A yes/no flag that lets the page show the right “Log in” or “My dashboard” button before it has checked with the API. Never a token. | Until you sign out | Functional |
| mbb-lang | The site language you chose from the language switcher. | Until you change or clear it | Functional |
| mbb-display-currency | The currency you chose for displayed prices. Prices are always charged in South African rand. | Until you change or clear it | Functional |
| mbb-cookie-notice | Remembers that you have seen the cookie notice, so it is not shown again. | Until you clear it | Functional |
| mbb-register-draft-v1 (session storage) | Keeps what you have typed on the registration form if the page reloads, in this tab only — without your password, passport number or passport scan. | Until you close the tab or complete registration | Functional |
5. Third parties
Some steps of the programme take you to a partner’s own page, which sets its own cookies under its own policy. We link to those pages rather than embedding them, so nothing from these services runs on this site while you browse it:
- Peach Payments — hosted card checkout. Card numbers never touch our servers.
- DocuSeal — the e-signing page for your three MBB agreements.
- WhatsApp — “message us” links open the WhatsApp app or website.
Two services are contacted directly by your browser while you use the site, and each sees your IP address and browser type as any web request does:
- Sentry (error monitoring, USA) — if a page or the API fails, a report of the technical error and the page it happened on is sent so we can fix it. Reports are scrubbed of personal information before they leave the browser; no cookie is set.
- flagcdn.com (country flag images) — the small flag icons in the country pickers are loaded from this image CDN. It receives the ordinary image request only; no cookie is set. We plan to serve the flags from our own site.
Fonts and all other images are served from our own site.
6. How to control cookies
- Sign out from your dashboard to remove both session cookies immediately. “Sessions” under your account lets you end sessions on other devices too.
- Your browser settings let you block or delete cookies and site data for any site. If you block cookies for this site you can still browse the bikes, the calculator and the FAQ, but you will not be able to sign in.
- Clearing site data in your browser removes the browser-storage values above; the site simply returns to its defaults (English, rand pricing, the notice shown again).
7. Changes and contact
If we ever add a cookie that is not strictly necessary, this page will say so first and you will be asked before it is set. Questions go to our Information Officer at kerrenwolfin@motobuyback.com. This policy is issued by Moto Buy Back (Pty) Ltd and should be read with our Privacy Policy and Terms of Service.