TrustFirst
Cookies and storage
What TrustFirst keeps on your device, why it is there, and how to get rid of it.
The short version
None. TrustFirst does not show adverts, so there is nothing to target and nobody to sell an audience to.
No Google Analytics, no Tag Manager, no Meta pixel, no Mixpanel, no Hotjar. Nothing measuring you across other websites, and nothing following you off TrustFirst.
Banners exist to ask permission for the optional things. Everything TrustFirst stores is needed for the app to work: to keep you signed in, to remember your settings, to let it open without a signal. There is nothing optional to ask about, so we do not interrupt you to ask it.
The two actual cookies
TrustFirst sets exactly two cookies, both from our own server, both necessary. The app itself never writes a cookie in your browser.
- What it does: identifies your session with our server so a page can tell it is still you.
- Who sets it: TrustFirst.
- Protections: HttpOnly, so no script can read it. Sent only over HTTPS. SameSite Lax, so another website cannot use it.
- How long: until it expires or you sign out.
- What it does: proves a form or request came from you on TrustFirst rather than from another site pretending to be you. It is a security measure, not a way of knowing who you are.
- Who sets it: TrustFirst.
- Protections: HttpOnly, HTTPS only, SameSite Lax.
- How long: about a year, or until you clear it.
What else is kept on your device
Most of what TrustFirst stores is not a cookie. It sits in your browser's own storage, it is never sent to another website, and much of it never leaves your device at all.
Around a hundred small entries, all named tf_, tf- or trustfirst-. Rather than list every one, here is what they are for:
- Staying signed in: your session and which accounts you have saved to switch between.
- How you like the app: dark or light, language, captions, data saver, the order of your profile tabs, notification preferences.
- Your own choices about other people: who you have blocked, muted, restricted, or told us not to suggest again.
- Drafts: a post or a clip you started and did not finish.
- Making it fast: a copy of your recent feed, messages and conversations, so the app opens instantly instead of blank.
- Things with a memory: which poll you voted in, which story you have seen, whether you have been shown a tutorial.
A larger store holding posts, messages, conversations, notifications and cached media, so the app works with no signal and syncs when one comes back.
It also holds your private encryption key. It is made on your device and is not sent to us, unless you turn on Message Backup, which sends us a copy locked with your PIN. It is why we cannot read your encrypted messages, and why clearing this data without a backup means those messages can never be opened again. See the Terms.
A copy of the app's own files and recent images, kept by the service worker so TrustFirst opens quickly and still opens when you are offline. Videos you have saved for offline watching live here too.
Other companies
We do not embed anybody's tracking code. A few services are contacted only at the moment you use the feature that needs them, and they may set their own storage under their own policies:
- Giphy: only while the GIF picker is open.
- Yoco: only when you are making a payment, on Yoco's own checkout page. Payment providers use storage to detect fraud, which is in your interest.
- LiveKit: only while you are in a live stream.
Close the picker, finish the payment, leave the stream, and nothing further is contacted.
When something breaks, a report goes to Sentry so we can find out why. It sets no cookies and does not record your screen, and personal fields are stripped out before it is sent.
Clearing it
Clear site data for TrustFirst in your browser settings, or delete and reinstall the app. That removes the cookies, the local storage, the offline copy and the cache in one go.
Signing out also clears what is personal to you from the device, so the next person to use it does not see your feed or your messages.
You will be signed out and your settings reset, which is a small annoyance.
Your encryption key goes with it. Encrypted messages already sent to you were locked for that key. Without it, or a message backup to restore it from, nobody can open them again, including us. If a conversation matters, save what you need before you clear anything.
You can, and TrustFirst will stop working. Without the session cookie there is no way to stay signed in, and without local storage there is nowhere to keep your keys or your settings. There is no version of this app that runs with no storage at all, and we would rather say so than let you fight it.