10 Seconds is operated by Sterling and Pierce Holding L.L.C-FZ, Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Contact: contact@10seconds.io (single point of contact for all matters).
This policy covers cookies and similar technologies used on the website and service under our control. Read it together with our Privacy Policy. External payment pages are addressed in Section 6.
Cookies and browser storage can contain personal data even where they use a pseudonym or technical identifier. Authentication identifiers may constitute personal data even when they do not contain your real name. Information stored locally on your device is distinct from data retained on our servers — an absence of server-side chat archives does not mean that your browser contains no information.
| Technology | Purpose and content | Duration and scope |
|---|---|---|
| session First-party Flask session cookie |
Maintains authenticated access using a signed user identifier and necessary session-security information. Signed is not encrypted: contents are not secret but any modification is detectable server-side. Does not contain chat messages, plaintext passwords, or private message-decryption keys. Not used for advertising or analytics. | Configured with HttpOnly, SameSite=Lax, and Secure in production. Lifetime: browser session cookie — the application does not mark the session as permanent and does not use "remember me" at login, so the cookie is cleared when the browser is closed and on logout. The server configures a 7-day ceiling (PERMANENT_SESSION_LIFETIME = 604 800 s) that would only apply if a future build enabled a "remember me" flow; it is currently not activated. Browser session restoration may retain the cookie client-side even after a window is closed. |
| CSRF protection Hidden form field; no separate CSRF cookie in the current implementation |
Validates form submissions to reduce cross-site request forgery. The hidden field is checked against security data in the existing session cookie; it does not necessarily operate independently of that cookie. | Validity bound to the session cookie's validity. Submission of a form must not be assumed to invalidate its token automatically. |
| chat_display_<room> First-party sessionStorage (not a cookie) |
Remembers the display name you entered for a particular chat room (the key also distinguishes the room). The storage entry is local to your browser and is not automatically attached to HTTP requests as a cookie would be. Application scripts can read it within the same origin. | Scoped to the website origin and page session, generally associated with a tab. It survives page reloads and may survive browser session restoration. It has no automatic 30-minute expiry merely because the chat expires. Cleared when the tab is closed, or on manual browser clear. |
The display-name entry is not a message archive. However, a room reference or pseudonym may still reveal information about your use of the service. Avoid using your real name as a display name where it is unnecessary.
To be unambiguous, 10 Seconds does not deploy any of the following, nor any equivalent, on pages under our control:
Cookies set for authentication or security are limited to their stated necessary purposes and are not repurposed for advertising or analytics.
In production, the authentication cookie is configured with Secure (restricts transmission to HTTPS), HttpOnly (restricts access through ordinary browser-side JavaScript), and SameSite=Lax (limits transmission in certain cross-site situations). These attributes do not encrypt the cookie contents and do not guarantee protection against every attack or a compromised device.
These cookie attributes do not apply to sessionStorage. Scripts running with access to the relevant origin may read browser storage. Browser extensions and device-level access can present additional risks.
Article 5(3) of Directive 2002/58/EC (ePrivacy) and its national implementing rules govern relevant storage of, or access to, information on a user's device. In France, Article 82 of the Data Protection Act (Loi n° 78-17 Informatique et Libertés) applies where relevant. The rules can cover cookies and similar browser storage, whether or not the information is personal data.
Prior consent is not required where the applicable strictly-necessary exemption (service expressly requested by the user, or transmission of a communication) is satisfied. Local storage, short duration, and first-party status do not, by themselves, establish an exemption; describing a technology as "functional" or "security-related" is likewise insufficient. A consent banner is unnecessary only where all relevant operations are exempt; optional operations requiring consent must remain inactive until a valid choice is made.
Where personal data is processed, the GDPR additionally requires an appropriate legal basis:
Where optional preference processing relies on consent, that consent may be withdrawn as easily as it was given. Further information in the Privacy Policy.
If you choose to pay by card, you are redirected to Stripe, Inc.'s hosted checkout. If you pay in cryptocurrency, you are redirected to CoinPayments.net Inc.'s hosted interface. These external pages are not under our control; they may use their own cookies and similar technologies for payment, security, or other disclosed purposes.
Consult the Stripe Cookies Policy and the CoinPayments privacy information, as applicable. The relevant contracting entity is identified in the provider's current checkout and legal notices.
Our descriptions of our own pages do not certify external providers' practices. Redirection does not remove our responsibilities for data we disclose or integrations we control. A payment purpose does not automatically exempt every technology used by a payment provider. Where provider scripts or embedded components operate on our pages, their device access and disclosures are assessed and included in the applicable notices and consent controls.
Availability of a payment method remains subject to applicable law and the Terms of Sale.
Where UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection and its implementing measures govern the processing, we process personal data only on a basis permitted by that framework (contract necessity or another applicable statutory exception, within the conditions set by law).
Where consent is required under UAE law, it must be informed, demonstrable, and capable of withdrawal through an accessible method. The European strictly-necessary exemption and the GDPR legitimate-interests basis are not treated as independent exemptions under UAE law.
Applicable rights depend on the relevant federal and state laws and their scope. We do not sell personal information and we do not share it for cross-context behavioural advertising through the technologies described in this policy. We do not use them for targeted advertising.
Where applicable law requires recognition of a qualifying opt-out preference signal — notably Global Privacy Control (GPC) — we honour that signal for the processing it legally covers. Such a signal is not a general request to disable authentication or necessary form protection.
Further information about applicable privacy rights and how to exercise them is in our Privacy Policy. This policy does not claim that every state privacy law applies to every visitor, or that technical necessity overrides a statutory right.
You can inspect and remove cookies and browser storage through the controls provided by your browser. Clearing cookies alone may not clear all other site storage; use the browser's "site data" controls where available.
Removing the authentication cookie normally ends authenticated access in that browser until you sign in again. It does not necessarily sign out other devices. Blocking the authentication cookie may prevent authenticated functions; blocking anti-forgery mechanisms may prevent form submission. Removing the display-name preference may require entering that name again.
Use the service's logout function on shared devices. Closing a window or allowing a chat to expire is not a guarantee that all browser information has been erased. Browser restoration, other tabs, and device-level copies may affect local persistence.
Private or incognito browsing generally limits the retention of local information after the private browsing session ends. It does not prevent cookies or browser storage from being used during that session, and does not make you anonymous to websites, payment providers, network operators, or other parties. Behaviour varies by browser and settings.
Deleting cookies does not automatically delete separate transaction records, invoices, correspondence, or other information lawfully held outside your browser. Requests concerning that information are addressed through the Privacy Policy.
We update this policy when the technologies, purposes, or relevant legal requirements change. We assess new integrations before use. Technologies requiring consent must not operate before that consent is obtained.
Where consent is required, choices must be clear and affirmative, refusal must be as easy as acceptance, and withdrawal must be accessible. Continued browsing, silence, and acceptance of general terms do not constitute such consent. New consent is obtained where required for a changed purpose.
Contact contact@10seconds.io for questions or privacy requests. The Privacy Policy describes applicable rights, recipients, international transfers, and complaint options. Contacting us is not a prerequisite to exercising a statutory right or contacting a competent authority.
Version 2026.14 · Effective 2026-10-22.
Published by Sterling and Pierce Holding L.L.C-FZ, Meydan Free Zone, Dubai, United Arab Emirates.
Contact: contact@10seconds.io