1. What are cookies
Cookies are small text files stored on your device by your browser when you visit a website. They allow the site to remember information about your visit across page loads and sessions — such as whether you are logged in.
2. Cookies we use
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| refresh_token | Keeps you signed in across browser sessions. Contains a secure, randomly generated authentication token that identifies your session. It contains no personal data — your email, name, and financial data are never stored in a cookie. | 7 days | Essential |
This cookie is protected by the following security attributes:
- HttpOnly — cannot be read or stolen by JavaScript. Protects against cross-site scripting (XSS) attacks.
- SameSite=Strict — not sent on any cross-site request. Protects against cross-site request forgery (CSRF) attacks.
- Secure — only transmitted over HTTPS. Never sent over an unencrypted connection.
- Path-restricted — only sent to the specific endpoint that handles token refresh, not to every API request.
This cookie is deleted immediately when you log out. If you do not log out, it expires automatically after 7 days of inactivity.
3. What we don't use
Specifically, SomedayFund does not use:
- Google Analytics or any Google tracking product
- Microsoft Clarity, Hotjar, FullStory, or any session recording tool
- Meta Pixel, TikTok Pixel, or any social media tracking
- Advertising networks of any kind
- A/B testing tools that rely on cookies
- Fingerprinting or any cookieless tracking alternative
We made this choice deliberately. SomedayFund handles sensitive financial data and we believe that embedding third-party surveillance tools into a personal finance app is incompatible with the trust users place in us.
Any usage analytics we run are based on aggregate, anonymised server-side data — no personal information, no cookies, and no third-party involvement.
4. Managing cookies
You can view and delete cookies at any time through your browser settings. The location varies by browser:
- Chrome — Settings → Privacy and security → Cookies and other site data
- Firefox — Settings → Privacy & Security → Cookies and Site Data
- Safari — Preferences → Privacy → Manage Website Data
- Edge — Settings → Cookies and site permissions
Deleting or blocking the refresh_token cookie will sign you out of SomedayFund. The next time you visit, you will need to sign in again. No other functionality is affected.
5. Policy changes
If we ever introduce additional cookies — for example, if we add an opt-in analytics tool in the future — we will update this policy and notify active users by email before the change takes effect. We will never introduce advertising or behavioral tracking cookies.
6. Contact
Questions about our use of cookies:
Email: support@somedayfund.app
Subject line: "Cookie enquiry"