Exactly what we set, and why.

Cookies are small data files placed on your browser or device. Similar technologies include local storage, session storage, pixels, and analytics tags that help websites understand traffic and remember settings.

The actual cookies set when you interact with PayBridgeNP. Anything not listed here, we don't set.

• __cf_bm (Cloudflare, all domains) - bot management, ~30 minutes. Strictly necessary; helps Cloudflare distinguish humans from automated traffic.
• cf_clearance (Cloudflare, all domains) - set when a visitor passes a Cloudflare challenge. Strictly necessary.
• _ga, _ga_* (Google Analytics, paybridgenp.com) - anonymous traffic measurement, 13-month expiry. We use Google Analytics to understand which marketing pages perform; no cross-site tracking is enabled.
• _fbp, _fbc (Meta Pixel, paybridgenp.com) - set by the Meta (Facebook) Pixel on the marketing site so we can measure how our Facebook and Instagram ads perform and show relevant ads to previous visitors. 90-day expiry. _fbc is only set when you arrive through a Facebook or Instagram ad link. Marketing site only - never on the merchant dashboard or the hosted checkout.
• pb_refresh (merchant dashboard, dashboard.paybridgenp.com) - HttpOnly, Secure, SameSite=Lax refresh-token cookie used to rotate short-lived dashboard JWTs. Set when you sign in (password, Google, or passkey) and cleared on sign-out or session revocation. Strictly necessary for authenticated dashboard use; not used for tracking.
• intercom-id-*, intercom-session-*, intercom-device-id-* (Intercom, merchant dashboard) - set by the Intercom support messenger so we can keep your support conversation going across visits. Set when the dashboard loads for a signed-in merchant.
• __pb_last_provider (PayBridgeNP hosted checkout) - remembers which payment method (eSewa, Khalti, or Fonepay) you last chose on that merchant's checkout, so the next checkout on the same domain pre-selects it as "Used last time". 90-day expiry; host-scoped (not shared across merchants). No personal data - only the provider name.
• __pbid_session (PayBridgeNP hosted checkout) - set if you opt in to PayBridgeNP ID after a successful payment. Lets you skip the form on any future PayBridgeNP-powered checkout. Optional; sign out from the buyer settings at id.paybridgenp.com to clear it.
• __pbid_optout (PayBridgeNP hosted checkout) - set when you dismiss the "Save with PayBridgeNP ID" prompt on the success page. Suppresses the prompt for 90 days. No personal data.
• __pbid_bridged_* (PayBridgeNP hosted checkout) - per-session bridge marker used only when a merchant uses a custom checkout domain (e.g. pay.merchantname.com). Allows the PayBridgeNP ID identity from the canonical domain to be recognised on the custom one for a single payment. Cleared automatically when the session ends.

The merchant dashboard (dashboard.paybridgenp.com) uses a single HttpOnly cookie, pb_refresh, to refresh short-lived access tokens. The access tokens themselves are held in browser memory only - never written to localStorage,sessionStorage, or IndexedDB. Signing out clears the refresh cookie immediately.

The hosted checkout (pay.* or merchant custom domains) only sets the buyer-experience cookies listed above when the relevant interaction happens - for example, __pb_last_provider is set on the first successful payment, and __pbid_session only after you explicitly opt in to PayBridgeNP ID. None of these cookies are required to complete a payment; declining or clearing them simply removes the autofill and pre-selection conveniences.

• Cloudflare sits in front of every PayBridgeNP domain for DNS, WAF, and CDN. The __cf_bm cookie above is set by Cloudflare directly.
• Google Analytics on paybridgenp.com (the marketing site only). We use a separate product-analytics tool, PostHog, on the merchant dashboard.
• Meta (Facebook) on paybridgenp.com (the marketing site only). The Meta Pixel reports page visits to Meta so we can measure our Facebook and Instagram ads and reach previous site visitors with relevant ads. Meta processes this data under its own privacy policy. Not present on the merchant dashboard or the hosted checkout.
• PostHog (merchant dashboard) - product analytics and error monitoring. Stores a device identifier in local storage (not a cookie) and records page views and exception details so we can keep the dashboard reliable.
• Intercom (merchant dashboard) - support messenger. Sets its own cookies (listed in the inventory above) to maintain your support conversation.
• Embedded YouTube videos (when present in blog posts) may set cookies under youtube.com when the video is played. We use youtube-nocookie.com embeds where possible.

PayBridgeNP is operated from Nepal and primarily serves Nepali merchants. We do not currently display a cookie consent banner. If you are visiting from a jurisdiction with stricter cookie consent rules (EU/UK), you can block cookies in your browser settings before continuing.

We will add a consent surface if and when our visitor profile or legal obligation makes it appropriate. The cookies above (excluding Google Analytics and the Meta Pixel) are either strictly necessary or set only after explicit authentication.

Most browsers allow you to clear existing cookies, block future cookies, or notify you before storage is set. If you disable strictly-necessary cookies (__cf_bm, cf_clearance), parts of the platform may stop working - Cloudflare may serve a challenge on every request.

You can opt out of Google Analytics across every site that uses it by installing Google's official opt-out browser extension.

You can control how Meta uses Pixel data about you from your Facebook or Instagram account under Settings > Accounts Centre > Ad preferences, or block the Pixel entirely with a browser content blocker. The marketing site works exactly the same without it.

For questions about analytics or website tracking, contact support@paybridgenp.com.