Cookie Policy
Last updated: February 10, 2026
This Cookie Policy ("Policy") explains how 3-102-954669 S.R.L., a sociedad de responsabilidad limitada organized under the laws of the Republic of Costa Rica (operating as "XEX"), and its subsidiaries, affiliates, and related entities (collectively, "XEX," "we," "us," or "our") use cookies, web beacons, pixel tags, local storage objects, and similar tracking technologies (collectively, "Cookies") when you visit or interact with the XEX cryptocurrency exchange platform, including the website located at xex.to, the XEX mobile applications, and all related services (collectively, the "Platform"). This Policy should be read in conjunction with our Privacy Policy, which provides comprehensive information about how we collect, use, and protect your personal information.
By continuing to use the Platform, you acknowledge that you have read and understood this Cookie Policy. Where required by applicable law, your continued use of the Platform after being presented with a cookie consent notice constitutes your consent to the use of Cookies as described herein, except for Strictly Necessary Cookies, which do not require consent.
1. What Are Cookies
Cookies are small text files that are placed on your device (computer, tablet, smartphone, or other internet-enabled device) when you visit a website or use an online service. Cookies are widely used to make websites function properly, to enhance functionality and user experience, to collect analytical data about website usage, and to deliver targeted advertising content.
Each cookie typically contains the name of the domain from which the cookie was set, the lifespan of the cookie (i.e., when it expires), and a value, which is usually a randomly generated unique identifier. Cookies can be set by the website you are visiting ("first-party cookies") or by third-party services that operate content or features embedded on that website ("third-party cookies").
In addition to traditional cookies, we also use the following related technologies, which function in a similar manner and are covered by this Policy:
- Web beacons (pixel tags): Small, transparent image files embedded in web pages or emails that allow us to track whether a page has been viewed or an email has been opened, and to collect information about the viewing device and time of access.
- Local storage objects: Data stored in your browser's local storage or session storage, which persists beyond the browser session (local storage) or until the browser session ends (session storage). These are used to store preferences, cache data, and support Platform functionality.
- Device fingerprinting: Techniques that collect information about your device configuration (such as browser type, operating system, installed plugins, screen resolution, and time zone) to create a unique identifier for your device, used for security and fraud prevention purposes.
- SDK identifiers: On mobile devices, software development kit (SDK) identifiers embedded in our mobile applications that function similarly to cookies and enable tracking and analytics within the app environment.
2. Types of Cookies We Use
We classify the Cookies used on the Platform into the following categories based on their purpose. Each category serves distinct functions that are essential to the operation, improvement, and commercialization of the Platform:
2.1 Strictly Necessary Cookies
These Cookies are essential for the operation of the Platform and cannot be disabled in our systems. They are typically set in response to actions you take that constitute a request for services, such as setting your privacy preferences, logging into your account, or completing a transaction. The Platform cannot function properly without these Cookies, and they do not require your consent under applicable law.
- Session management cookies: These maintain your authenticated session while you navigate the Platform, ensuring that you are not required to re-enter your credentials on each page. They are critical for account security and functionality.
- Security cookies: These protect against unauthorized access to your account and detect potentially malicious or anomalous activity. They include tokens used for bot detection, rate limiting, and device recognition.
- CSRF (Cross-Site Request Forgery) protection tokens: These prevent malicious websites from executing unauthorized actions on your account by embedding unique tokens in forms and requests that are validated server-side.
- Load balancing cookies: These distribute traffic across our servers to ensure optimal performance and availability of the Platform.
- Cookie consent cookies: These store your cookie consent preferences so that you are not repeatedly prompted to provide consent.
2.2 Functional Cookies
Functional Cookies enable enhanced functionality and personalization of the Platform. They may be set by us or by third-party providers whose services we have integrated into the Platform. If you disable these Cookies, some or all of these features may not function properly.
- User preference cookies: These remember your settings and preferences, such as your preferred display currency, chart type, trading view layout, theme (light/dark mode), and notification preferences.
- Language cookies: These store your preferred language setting so that the Platform is displayed in your chosen language on subsequent visits.
- Region and locale cookies: These detect and store your geographic region to display localized content, currencies, and regulatory notices appropriate to your jurisdiction.
- Live chat and support cookies: These enable our customer support chat widget to function, preserve your support history, and route you to the appropriate support agent.
- Feature flag cookies: These control the rollout of new features and experiences, enabling us to deliver different versions of the Platform to different Users for testing and optimization purposes.
2.3 Analytics Cookies
Analytics Cookies allow us to measure and analyze how Users interact with the Platform, including which pages are most frequently visited, how Users navigate between pages, and whether Users encounter errors. All information collected by these Cookies is aggregated and used to improve the performance and usability of the Platform.
- Google Analytics: We use Google Analytics to collect statistical data about Platform usage, including page views, session duration, bounce rate, traffic sources, and user demographics. Google Analytics uses first-party cookies to track User interactions. Google's use of the data collected through Google Analytics is governed by the Google Privacy Policy. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
- Performance monitoring cookies: We use application performance monitoring (APM) tools to track page load times, API response times, error rates, and other performance metrics. These Cookies help us identify and resolve technical issues that affect the User experience.
- Heatmap and session recording cookies: We may use tools that record mouse movements, clicks, scrolls, and keystrokes (excluding sensitive input fields such as passwords and financial data) to understand how Users interact with the Platform's interface and to identify usability issues.
- A/B testing cookies: These assign Users to experimental groups to measure the effectiveness of different design variations, feature implementations, and content presentations.
2.4 Marketing and Advertising Cookies
Marketing Cookies are used to track Users across websites and display advertisements that are relevant and engaging for individual Users. They are also used to measure the effectiveness of advertising campaigns and to limit the number of times you see a particular advertisement.
- Retargeting cookies: These enable us to display targeted advertisements to Users who have previously visited the Platform when they browse other websites or social media platforms. Retargeting is facilitated by advertising networks such as Google Ads, Meta (Facebook/Instagram), and similar platforms.
- Conversion tracking cookies: These measure whether a User completes a desired action (such as account registration or a first trade) after clicking on one of our advertisements. This data helps us evaluate the return on investment of our advertising spend and optimize future campaigns.
- Social media cookies: These are set by social media platforms (such as Twitter/X, LinkedIn, and Telegram) when you interact with social media content embedded on the Platform, or when you share Platform content on social media. These Cookies may track your browsing behavior across websites for advertising purposes.
- Attribution cookies: These identify which marketing channel, campaign, or referral source led a User to the Platform, enabling us to measure marketing effectiveness and allocate resources accordingly.
3. Third-Party Cookies
In addition to first-party Cookies set directly by XEX, certain third-party services embedded in or integrated with the Platform may set their own Cookies on your device. These third-party Cookies are governed by the respective third party's privacy and cookie policies, and XEX does not have control over the setting or management of these Cookies. The primary categories of third-party Cookie providers include:
3.1 Analytics Providers
We integrate third-party analytics services to gain insights into Platform performance and User behavior. These providers include, but are not limited to:
- Google Analytics / Google Tag Manager: Provides comprehensive website analytics, audience segmentation, and event tracking. Data may be processed in the United States and other jurisdictions where Google operates.
- Mixpanel: Provides product analytics, including user journey tracking, funnel analysis, and retention metrics.
- Amplitude: Provides behavioral analytics and product intelligence, including user segmentation and cohort analysis.
- Sentry / Datadog: Provides error monitoring, performance tracking, and real-time alerting for technical issues.
3.2 Advertising Networks
We may partner with advertising networks to deliver and measure the effectiveness of advertising campaigns. These networks may set Cookies to collect information about your browsing behavior across multiple websites:
- Google Ads: Facilitates search and display advertising, conversion tracking, and remarketing across the Google Display Network.
- Meta Pixel (Facebook/Instagram): Enables targeted advertising, conversion tracking, and audience creation on Meta platforms.
- Twitter/X Pixel: Supports conversion tracking and tailored audience targeting on the Twitter/X platform.
- LinkedIn Insight Tag: Enables conversion tracking, retargeting, and audience demographics reporting for LinkedIn advertising campaigns.
3.3 Social Media Embeds
The Platform may include embedded content from social media platforms, such as share buttons, embedded posts, or social login functionality. When you interact with this embedded content, the respective social media platform may set Cookies on your device even if you do not click on the embedded content:
- Twitter/X embeds and share buttons
- Telegram widgets
- Discord widgets
- YouTube embedded videos
We encourage you to review the privacy and cookie policies of these third-party providers to understand how they use Cookies and process your data. XEX is not responsible for the privacy practices of any third party.
4. Cookie Details
The following table provides detailed information about the specific Cookies used on the Platform. This list is reviewed and updated periodically, and the actual Cookies present on the Platform may vary as we update our services and integrations:
| Cookie Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| xex_session | XEX | Maintains authenticated user session and session state across page navigations | Session (expires on browser close) | Strictly Necessary |
| xex_csrf | XEX | CSRF protection token to prevent cross-site request forgery attacks | Session | Strictly Necessary |
| xex_device_id | XEX | Unique device identifier for security monitoring and fraud detection | 1 year | Strictly Necessary |
| xex_auth_token | XEX | JWT authentication token for API requests and session validation | 24 hours (refreshable) | Strictly Necessary |
| xex_cookie_consent | XEX | Stores the user's cookie consent preferences and selections | 1 year | Strictly Necessary |
| xex_lb | XEX | Load balancer affinity cookie for optimal server routing | Session | Strictly Necessary |
| xex_2fa_trust | XEX | Remembers trusted devices for two-factor authentication to reduce friction | 30 days | Strictly Necessary |
| xex_preferences | XEX | Stores user interface preferences including theme, layout, and display settings | 1 year | Functional |
| xex_lang | XEX | Stores the user's preferred language for the Platform interface | 1 year | Functional |
| xex_currency | XEX | Stores the user's preferred display currency for prices and balances | 1 year | Functional |
| xex_chart_settings | XEX | Preserves trading chart configuration, indicators, and timeframe selections | 1 year | Functional |
| xex_recent_pairs | XEX | Stores recently viewed trading pairs for quick access | 90 days | Functional |
| _ga | Google Analytics: Distinguishes unique users by assigning a randomly generated identifier | 2 years | Analytics | |
| _ga_* | Google Analytics 4: Maintains session state and collects analytics data | 2 years | Analytics | |
| _gid | Google Analytics: Distinguishes users for a 24-hour period | 24 hours | Analytics | |
| _gat | Google Analytics: Throttles request rate to limit data collection on high-traffic pages | 1 minute | Analytics | |
| mp_* | Mixpanel | Mixpanel analytics: Tracks user interactions, events, and product usage patterns | 1 year | Analytics |
| xex_ab_test | XEX | Assigns user to A/B testing groups for feature experimentation | 90 days | Analytics |
| _gcl_au | Google Ads: Stores conversion data and links ad clicks to on-site actions | 90 days | Marketing | |
| _fbp | Meta | Meta Pixel: Identifies browsers for ad delivery, measurement, and retargeting | 90 days | Marketing |
| _fbc | Meta | Meta Pixel: Stores the last Facebook ad click identifier for conversion attribution | 90 days | Marketing |
| li_fat_id | LinkedIn Insight Tag: Member indirect identifier for conversion tracking and retargeting | 30 days | Marketing | |
| xex_referral | XEX | Tracks referral source and campaign attribution for marketing analytics | 30 days | Marketing |
| xex_utm_* | XEX | Stores UTM campaign parameters for marketing channel attribution | 30 days | Marketing |
Note: The above table is representative and may not be exhaustive. Third-party providers may update their cookie names, purposes, or durations without notice to XEX. We periodically review and update this table to reflect current practices.
5. How to Manage Cookies
You can control and manage Cookies through your browser settings. Most web browsers allow you to view, delete, and block Cookies from websites. Please note that if you delete or block Cookies, some features of the Platform may not function properly, and your user experience may be degraded. Below are instructions for managing Cookies in the most commonly used browsers:
5.1 Google Chrome
Open Chrome and navigate to Settings > Privacy and Security > Cookies and other site data. From this menu, you can choose to block third-party cookies, block all cookies, clear cookies when you close Chrome, or manage exceptions for specific websites. You can also view and delete individual cookies by navigating to Settings > Privacy and Security > Cookies and other site data > See all cookies and site data. For more information, visit Google Chrome Help.
5.2 Mozilla Firefox
Open Firefox and navigate to Settings > Privacy & Security. Under the "Enhanced Tracking Protection" section, you can choose Standard, Strict, or Custom protection levels. The Custom option allows you to specify which types of trackers and Cookies to block, including third-party tracking cookies, cryptominers, and fingerprinters. You can view and delete stored Cookies by clicking on Manage Data under the "Cookies and Site Data" section. For more information, visit Firefox Support.
5.3 Apple Safari
Open Safari and navigate to Safari > Settings > Privacy (on macOS) or Settings > Safari > Privacy & Security (on iOS). Safari blocks third-party cookies by default through its Intelligent Tracking Prevention (ITP) feature. You can further configure Cookie settings by selecting "Block all cookies," though this may prevent some websites from functioning properly. You can view and manage stored website data by clicking Manage Website Data. For more information, visit Apple Safari Support.
5.4 Microsoft Edge
Open Edge and navigate to Settings > Cookies and site permissions > Manage and delete cookies and site data. You can choose to block third-party cookies, block all cookies, or clear cookies when you close the browser. Edge also offers tracking prevention with Basic, Balanced, and Strict levels, accessible under Settings > Privacy, search, and services > Tracking prevention. You can view and remove individual cookies from the site permissions page. For more information, visit Microsoft Edge Support.
5.5 Additional Opt-Out Mechanisms
In addition to browser-level controls, you may opt out of certain third-party tracking and advertising Cookies through the following industry opt-out tools:
- Network Advertising Initiative (NAI): https://optout.networkadvertising.org
- Digital Advertising Alliance (DAA): https://optout.aboutads.info
- European Interactive Digital Advertising Alliance (EDAA): https://www.youronlinechoices.eu
- Google Analytics Opt-out: https://tools.google.com/dlpage/gaoptout
6. Impact of Disabling Cookies
If you choose to disable or block certain categories of Cookies, you should be aware that your experience on the Platform may be materially affected. The consequences of disabling Cookies vary depending on the category:
- Strictly Necessary Cookies: These Cookies cannot be disabled through our cookie consent mechanism. They are essential for the basic operation of the Platform. If you block these Cookies at the browser level, the Platform may not function at all -- you may be unable to log in, execute trades, or access your account. We are not responsible for any loss of functionality resulting from browser-level blocking of Strictly Necessary Cookies.
- Functional Cookies: Disabling Functional Cookies will result in the loss of personalization features. Your preferred language, display currency, chart settings, and other preferences will not be remembered between sessions, and you will need to reconfigure these settings each time you visit the Platform.
- Analytics Cookies: Disabling Analytics Cookies does not affect the functionality of the Platform from your perspective. However, it prevents us from collecting data about your usage patterns, which limits our ability to identify and fix issues, improve performance, and enhance the user experience.
- Marketing Cookies: Disabling Marketing Cookies means that the advertisements you see may be less relevant to your interests. It does not mean you will see fewer advertisements overall; rather, the advertisements displayed will be generic and not tailored to your browsing behavior or interests.
XEX shall not be liable for any loss, inconvenience, or degradation of service resulting from your decision to disable or block Cookies, whether at the browser level or through our cookie consent mechanism.
7. Cookie Consent
In accordance with the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations (PECR), and other applicable privacy laws, we obtain your consent before placing non-essential Cookies on your device. Our consent mechanism operates as follows:
7.1 Consent Mechanism
When you first visit the Platform, you will be presented with a cookie consent banner that provides a clear summary of the categories of Cookies we use and the purposes for which they are used. The banner offers you the following choices:
- Accept All: By clicking "Accept All," you consent to the use of all categories of Cookies, including Functional, Analytics, and Marketing Cookies.
- Manage Preferences: By clicking "Manage Preferences" (or equivalent), you can selectively enable or disable individual categories of non-essential Cookies. Strictly Necessary Cookies will remain enabled regardless of your selection, as they are required for the Platform to function.
- Reject Non-Essential: By clicking "Reject" (or equivalent), you decline consent for all non-essential Cookies. Only Strictly Necessary Cookies will be placed on your device.
7.2 Withdrawal of Consent
You have the right to withdraw your consent to non-essential Cookies at any time. You can withdraw consent through the following methods:
- Cookie settings panel: You can access our cookie settings panel at any time by clicking the "Cookie Settings" link in the footer of the Platform. This panel allows you to review and modify your consent preferences for each category of Cookies.
- Browser settings: You can delete existing Cookies and configure your browser to block future Cookies as described in Section 5 above.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Once you withdraw consent, we will cease placing the relevant non-essential Cookies on your device going forward, but Cookies that were already placed prior to withdrawal may remain on your device until they expire or you manually delete them through your browser settings.
7.3 Managing Preferences
Your cookie preferences are stored in a first-party cookie (xex_cookie_consent) on your device and are respected across all pages of the Platform during your current and future visits. If you clear your browser's cookies, your consent preferences will be reset, and you will be presented with the cookie consent banner again on your next visit.
Please note that cookie consent is device- and browser-specific. If you access the Platform from multiple devices or browsers, you will need to set your cookie preferences on each device and browser separately.
7.4 Changes to This Cookie Policy
We reserve the right to update this Cookie Policy at any time to reflect changes in our use of Cookies, changes in applicable law, or for any other reason. Any changes will be effective immediately upon posting the revised Policy on the Platform with an updated "Last updated" date. Where material changes are made to the categories of Cookies used or the purposes for which they are used, we may re-present the cookie consent banner to obtain your updated consent.
Your continued use of the Platform after the posting of any changes to this Cookie Policy constitutes your acknowledgment and acceptance of those changes. If you do not agree with the updated Cookie Policy, you should discontinue your use of the Platform and delete any existing XEX Cookies through your browser settings.
7.5 Contact Us
If you have any questions or concerns about this Cookie Policy or our use of Cookies, please contact our Data Protection Officer at dpo@xex.to or write to us at:
- Email: dpo@xex.to
- Subject line: "Cookie Policy Inquiry"
- Postal address: XEX (3-102-954669 S.R.L.), Attn: Data Protection Officer, Calle 37, Avenida Tercera, Oficina 101, Barrio Dent, San Pedro, Montes de Oca, San José, Costa Rica