Cookie policy
Three cookies on our own site. None at all on the offerwall.
AESHA Technology Services Limited · Last revised 7 October 2026 · All legal documents
The offerwall sets no cookies
The offerwall — every page under /wall — sets no cookies, reads
no cookies, and starts no session. Neither do the API, the postback endpoints or the
scheduled-job endpoints.
This is structural rather than a policy we promise to keep. Those paths are listed in
SESSIONLESS_PATH_PREFIXES, which makes the application skip session handling
entirely before any page code runs, and the test suite asserts on every release that no
Set-Cookie header is sent from them.
The reason is practical as much as principled. The wall is shown inside an iframe on a publisher's own domain, so any cookie we set would be a third-party cookie: blocked by default in most browsers, and never sent back to us where it is not. Building on one would have produced an integration that quietly failed for most users.
A user is identified instead by the id the publisher puts in the wall URL. Nothing is stored on their device by us.
Our own site sets three
Signing in to a publisher, advertiser, admin or support account needs to remember that you are signed in. That takes two cookies. A third is set only if you arrive through somebody's referral link.
| Cookie | Purpose | Lifetime |
|---|---|---|
OWGGSESSID |
The session identifier. Keeps you signed in as you move between pages, and carries the CSRF token that stops a third-party page acting as you. | 24 hours |
JWT |
Set only if you tick remember me. A signed token that restores your session on a later visit. Not set otherwise. | 7 days |
ow_ref |
Set only if you arrive through a referral link
(https://offerwall.gg/r/…). It holds that
affiliate's referral code and nothing else — no identifier for you, and
nothing that follows you to any other site. If you later create a publisher
account, it is read once to record who introduced you, and it is never read
again. Not set otherwise. |
90 days |
All three are HttpOnly, so page scripts cannot read them;
SameSite=Lax, so they are not sent from another site; and
sent only over HTTPS.
What we do not use
- No advertising or retargeting cookies of our own. We do not build profiles and we do not sell audiences. The blog, and the bottom of the offerwall, show a display ad in a frame served by ZerAds, which may set its own cookies inside that frame. We set none there, and no other page carries them.
- No third-party analytics. The numbers on the dashboards come from our own database — the clicks and conversions the platform already records to pay people — not from an analytics script.
- No cross-site tracking. There is nothing to consent to on the wall because we set nothing there (the ZerAds frame above is the one third party on it). The referral cookie is first-party, readable only by this site, and records which affiliate to credit — not where you go.
Turning them off
You can block or delete cookies in your browser. Blocking the two above means you cannot stay signed in to a dashboard, since there is no other way for the site to recognise a returning session. It has no effect on the offerwall, which never used one.
Related
The privacy policy covers what we hold and why. The subprocessors page lists every third party that sees anything.