What cookies are set on RoamFX, the few that need your consent, and how to change your choices at any time.
Last updated: July 2026
Cookies are small text files stored in your browser when you visit a website. They have a range of uses. Some are essential for a site to work, others track your behaviour across the web for advertising purposes.
Not all cookies are equal, and not all cookies require your consent. Under GDPR and the EU ePrivacy Directive, only non-essential cookies (primarily analytics and advertising) require prior consent. Strictly necessary cookies, which a site can't function without, are exempt. In practice, "strictly necessary" means cookies required for the site to load, stay secure, and serve pages quickly.
Analytics, advertising measurement, and Google Maps all stay off by default for EEA and UK visitors. Only strictly necessary cookies (security, keeping the site online) need no consent and always run.
Under GDPR and the EU ePrivacy Directive, only non-essential cookies and similar tools (mainly analytics and advertising) need your prior consent. Strictly necessary cookies are exempt. On RoamFX, three things need consent: analytics (Google Analytics), advertising measurement (Google Ads and Microsoft Ads), and embedded Google Maps.
We decide whether to show a consent banner by your location, detected at our CDN edge. If you're in the European Economic Area or the United Kingdom, you see a short banner with Accept all, Reject all, and a Customise option, and nothing that needs consent loads until you choose. Reject is one click, exactly as easy as accept. Visitors elsewhere have these enabled by default, in line with local rules, and can switch them off at any time from the control further down this page or in the footer.
We use Google Analytics only to understand how the site is used in aggregate, never to profile your browsing across the web. We don't use a general Google Tag Manager container, a Facebook Pixel, or any cross-site tracking beyond the ad-conversion measurement described below. You can verify what's stored at any time: open your browser's developer tools, go to the Application tab, and check the cookies and local storage for roamfx.com against the tables below.
These cookies are always set, because the site can't load, stay secure, or be measured fairly without them. All are strictly necessary and none require consent.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm | Cloudflare | Bot management. Helps Cloudflare distinguish legitimate browsers from automated traffic so the site stays online during scrape and abuse attempts. Not used to track browsing behaviour. | 30 minutes |
_cfuvid | Cloudflare | Used by Cloudflare's rate-limiting rules to identify the current session so a single visitor can't flood the site with requests. Set only when those rules are triggered. | Session |
Both are used purely for security and abuse prevention by our CDN. Neither tracks browsing behaviour, links you to other sites, or shares data with ad networks. Cloudflare's full list of cookies it may set is documented at developers.cloudflare.com.
These are set by Google and Microsoft only after you allow the matching category (analytics or advertising measurement). The analytics cookies can be set on any page; the advertising ones only on the pages that use it (mainly our paid eSIM landing pages). If you reject, or haven't yet chosen, none of them are set.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics. Distinguishes one visitor from another so we can count visits and see which pages get used. Set only with analytics consent. Holds a randomly generated id, not your name or email. | 2 years | |
_ga_<id> | Google Analytics session state for our specific property. Works with _ga to measure visits and page use. Set only with analytics consent. | 2 years | |
_gcl_au | Google Ads conversion linker. Helps attribute a sale on a partner's site back to the ad you clicked, so we can measure which ads work. Set only with advertising consent. | 90 days | |
_uetsid / _uetvid | Microsoft | Microsoft Advertising (UET) session and visitor ids, used for the same conversion-measurement purpose on Microsoft/Bing ads. Set only with advertising consent. | 1 day / 390 days |
We do not set advertising cookies of our own, and we don't run on-site display ads or share your browsing with ad exchanges. The cookies above exist purely so we can tell which of our own ads led to a sale and reach similar travellers. Google's and Microsoft's own controls and policies are linked in the advertising section below.
We periodically review the cookies set on the site. If a service update introduces something new, this page is updated to match.
Cookies aren't the only way a site can store data in your browser. Modern sites can also use local storage and session storage, which work similarly but don't get sent back to a server with every request. EU guidance treats these the same as cookies for consent purposes, so we disclose them here for completeness.
RoamFX uses a few small pieces of browser storage to make the search box and the currency tools feel fast:
| Key | Type | Purpose | Duration |
|---|---|---|---|
rfx-search-recent-v2 | Local storage | Remembers the last few destinations you opened from the search box so they show up the next time you open it. Stores only the destination name and URL, up to four entries. Never sent to our servers. | Until you clear browser data |
rfx_currencies_… | Local storage | Caches the day's list of supported currencies so the currency tools don't re-download it on every page. The date is part of the key so it refreshes once a day. | Replaced daily |
rfx_fx_… | Local storage | Caches recently looked-up exchange rates (for example a EUR→GBP rate) so the converter and comparison tables don't re-fetch the same rate as you browse. Holds rate numbers only. | Refreshed automatically |
rfx-geo-cc | Session storage | Stores the two-letter country code we detect for you (via our CDN) so the spending and converter tools can default to your home country. Cleared automatically when you close the tab. | Until you close the tab |
rfx-consent | Local storage | Remembers your privacy choices (analytics, advertising measurement, and maps, on or off) so we don't ask again on every page. Stores your selections, a timestamp, and the country we detected. Storing your choice is itself strictly necessary, so it's set regardless of what you choose. | Until you clear browser data |
None of these is used to identify you, track you across pages, or build a profile. They hold only the data described above, on your own device, purely so search and the currency tools feel fast and remember your own recent picks. Because they're strictly necessary for features you're actively using, they're exempt from consent requirements under EU ePrivacy guidance. You can clear them at any time through your browser's site data settings.
We use Google Analytics 4 to understand how people use the site: total visits, which pages get read, where visitors come from, and country-level location. This runs only with your consent. If you're in the EEA or UK, Google Analytics does not load and sets no cookies until you allow the analytics category; elsewhere it's on by default and you can switch it off any time.
When it does run, Google Analytics sets the _ga and _ga_<id> cookies listed above to tell one visit apart from another. We use it purely in aggregate. We do not use it to build a cross-web profile of you, we don't link it to your name or email, and we have IP anonymisation on. Google Consent Mode is configured so that if you don't consent, no analytics tags fire at all. Google's privacy policy is at policies.google.com/privacy, and you can opt out of Google Analytics across all sites with Google's browser add-on.
On our eSIM landing pages we keep a simple first-party view counter. When one of those pages loads, your browser tells us the page's name so we can add one to that page's daily total, along with the device type (phone or desktop) and the country our network sees. It sets no cookies, stores no IP address, and holds nothing that identifies you. It is only ever a running count per page, per day, so we can see which landing pages and offers are working. Because it holds no personal data, it needs no consent.
We advertise RoamFX on Google Ads and Microsoft Ads. To see which of those ads actually lead to a sale (and to reach travellers like the ones who already found us useful), we use Google's and Microsoft's measurement tags on our paid landing pages. With your consent, these set the cookies listed above and let us record a conversion when a click turns into a purchase on a partner's site. We do not use them to build a cross-web profile of you, and we don't sell your data.
Part of this measurement is cookieless: when you arrive from an ad, the click id in the URL travels with your visit to our redirect and is stored on our server against that click, so a later sale can be reported back to the ad platform. This too runs only with your advertising consent, and we delete those click ids after 90 days. You can control all of it with the advertising toggle in your privacy choices. Google's controls are at policies.google.com/privacy and Microsoft's at privacy.microsoft.com.
Google Maps is embedded on some destination and country pages to show areas, routes, and points of interest. Google sets its own cookies when a map loads, so we load a map only once you've allowed the maps category in your privacy choices. Outside the EEA and UK that's on by default. In the EEA and UK a map stays as a placeholder, with a button to open your privacy choices, until you allow maps. Once maps are allowed, embedded maps load straight away; if you never allow them, no Google Maps cookies are ever set. Your choice is stored in the rfx-consent entry above. Google's privacy policy is at policies.google.com/privacy.
When you click an affiliate link and land on a partner's site, that site sets its own cookies under its own privacy policy, which we don't control or see. Some outbound links carry tracking parameters in the URL so partners can attribute the referral; those travel with the click and don't set cookies on RoamFX itself.
Our own redirect also logs the click so we can measure which links and pages perform. That record holds the link, the time, the position on the page, the referring page, the traffic source, and coarse device and country signals. We never store your raw IP address: it is turned into a one-way scrambled hash that cannot be traced back to your address, and no cookie is set for this. If you arrived from one of our ads and allowed advertising measurement, the ad click id is stored with it and deleted after 90 days, as described above.
You can review or change your analytics, advertising, and maps choices at any time, from any page. Withdrawing consent is as easy as giving it, and takes effect immediately for anything loaded after that. It doesn't undo data already collected while consent was active; for that, see the deletion and retention details in our privacy policy.
Open the privacy choices panel to turn analytics, advertising measurement, and maps on or off.
If we add or change anything that needs consent, this page is updated and the privacy choices panel is updated to match, so you're always asked before anything new is set.
The "last updated" date at the top reflects the most recent change. For anything that materially affects how cookies are used, we'll post a notice on the site.