Legal
Cookie Policy
This document is provided as-is and is not legal advice. Consult counsel before relying on it.
Last updated 2026-08-28. This policy explains how Pocket-CFO uses cookies and similar technologies.
What we use
Pocket-CFO uses strictly necessary cookies and equivalent secure storage for authentication, session management, and security. These are required for the service to function and cannot be declined. We use preference storage to retain application settings across sessions. We use analytics technologies, including Google Tag Manager, Hotjar (session replay), Contentsquare (session replay and behavioural analytics), PostHog (product analytics), and Vercel Web Analytics (cookieless page-view analytics on the website), to understand how the product is used and identify improvements, but only if you explicitly accept analytics cookies via the consent banner. Not every analytics tool listed here is enabled in every build; see our Subprocessor List for the current status, purpose, and data received for each vendor we work with. We do not use advertising or tracking cookies for third-party marketing purposes.
Cookie consent
First-time visitors to the Pocket-CFO website are shown a cookie consent banner before any optional cookies are loaded. Analytics and preference cookies require explicit acceptance. If you decline, only strictly necessary cookies are used. You may revisit and update your cookie preferences at any time using the cookie consent component available in the page footer. Withdrawing consent will stop future loading of optional cookies but does not delete cookies already placed during a prior consent period unless you clear them through your browser.
Third-party storage
Supabase authentication tokens are stored in browser session storage, scoped to your browser session, cleared when the tab closes, and protected by the same-origin policy; they are required for login. Hotjar, Contentsquare, and Google Tag Manager scripts are loaded only after you provide consent and may set their own cookies subject to their respective privacy policies, which we encourage you to review. If you later withdraw consent, Pocket-CFO stops sending to all of them immediately and signals the withdrawal to Google Tag Manager directly. Session replay is the exception we want to be plain about: once the Hotjar or Contentsquare recorder has loaded it continues capturing that page on its own until you navigate or reload, because neither provides a way for a page to stop it. Vercel Web Analytics sets no cookies and stores no identifier in your browser, but its script is still loaded only after you accept analytics cookies and stops sending as soon as you withdraw that consent. Pocket-CFO does not control the cookies or storage set by these third parties once their scripts are loaded.
Managing cookies
You can clear or block cookies at any time through your browser settings. Blocking strictly necessary cookies or deleting the Supabase session token will prevent login and break core application functionality. The Pocket-CFO mobile apps use equivalent secure native storage rather than browser cookies, but follow the same consent semantics for analytics. Opt-out signals such as Global Privacy Control are honored by Pocket-CFO where technically supported and will be treated as a withdrawal of consent for non-essential cookies.
