Cookies Policy

1. What is a cookie?

A cookie is a small text file that a website places on your device. We also use related technologies — local storage and session storage — that work similarly but are stored within your browser rather than sent with every request. We refer to all of these collectively as “cookies” here.

2. Cookies we use

Strictly necessary

These cookies are required for the Service to work. You cannot opt out of them and still use the Service.

• Authentication tokens — set by Supabase to keep you signed in across pages.
• CSRF / session protection — protects sensitive actions like checkout, password change, account deletion.
• Load-balancing and routing — set by Vercel to route your requests to the right server.
• Preferences — small values (theme: light / dark / auto, language, pinned currencies, accepted disclaimers, dismissed onboarding) saved in local storage so the app remembers your choices on this device.

Functional

• Form-state retention — short-lived storage that keeps your unsaved input across navigations within a session.
• Onboarding / banner state — remembers whether you have dismissed a welcome banner, an upgrade banner, or a one-time tutorial.

Analytics (only if enabled)

We may use first-party, privacy-respecting analytics to understand which features are used and how the app performs. When in use, analytics cookies are configured to: minimise personal data, never share with advertising networks, and respect browser “Do Not Track” signals. We will list specific analytics providers here if and when we add them.

Third-party

Stripe sets its own cookies on its checkout and billing portal pages to process payments securely and detect fraud. See Stripe’s cookie policy at stripe.com/legal/cookies-policy. We do not control those cookies.

3. Your choices

• Block or delete cookies in your browser settings. Most browsers let you remove cookies, block third-party cookies, or run in private / incognito mode. Blocking strictly necessary cookies will break sign-in and most app features.
• Clear local storage via your browser’s site-data tool. Doing so resets your preferences and signs you out.
• Global Privacy Control — when your browser sends a GPC signal we treat it as an opt-out of any non-essential tracking that would otherwise apply.

4. Updates

If our use of cookies changes materially we will update this page and the “Last updated” date at the top. Questions? Write to support@capitalfortress.org.