Cookie Policy
Last updated
1. Introduction
This policy explains the small amount of information Verdly stores on your device, and why.
We’ve written it as a “Cookies & Local Storage Policy” rather than a “Cookie Policy” because, in our case, the second name fits better — we don’t use traditional tracking cookies, but we do rely on your browser’s local storage to keep you signed in and remember a few preferences. Under UK and EU regulations (the Privacy and Electronic Communications Regulations and the GDPR), the rules for cookies, local storage, session storage, and similar technologies are the same. So we treat them the same here.
If you’ve read our Privacy Policy, this document complements it by focusing specifically on what we store directly in your browser.
2. Our approach
Verdly is built around the idea that your financial information is yours. That principle shapes what we store on your device:
- No advertising cookies. Verdly carries no ads and no advertising trackers.
- No marketing or profiling analytics. We don’t use Google Analytics, Meta Pixel, Mixpanel, Hotjar, or any equivalent. We don’t build a profile of you, and we don’t share behavioural data with anyone.
- No cross-site tracking. Nothing we store can be used to follow you around the web.
- Only what’s needed. Everything below is limited to keeping you signed in, remembering settings you’ve explicitly chosen, protecting the service from abuse, and finding faults in the app.
We do not ask your permission for any of it, and we do not need to. What we store is either required to sign you in, or a setting you turned on yourself, or — in one case, for a moment — a check that your browser permits storage at all. None of those needs your consent.
Error and performance monitoring keeps nothing. We used to ask before running it, because it kept a session id in your browser; in September 2026 we changed it so that it keeps nothing, and stopped asking. It now runs for everyone. Section 3.3 describes the one momentary exception, which stores nothing about you. If you would rather it did not, you can block faro-collector-prod-gb-south-1.grafana.net in your browser, or email us at [email protected].
3. What we store on app.verdly.io
3.1 Strictly necessary
These are required for the app to work. Without them, you can’t sign in or complete the actions you’ve asked Verdly to perform.
| Item | Where it’s stored | Purpose | Lifetime |
|---|---|---|---|
| Authentication tokens | Local storage (set by AWS Cognito) | Keeps you signed in across page reloads. Stored under keys beginning CognitoIdentityServiceProvider.* | Until you sign out or clear your browser data; refresh token expires after ~30 days of inactivity |
| Onboarding draft | Local storage (verdly.onboarding.draft) | Preserves your signup form if you reload the page mid-way. Contains details you’ve entered during onboarding, including name, country, currency, date of birth, retirement age, salary, and your first milestone | Cleared automatically when you complete onboarding |
| Email re-send cooldown | Session storage (auth-resend-cooldown:*) | Prevents accidental repeated requests for verification or password-reset emails. Your email address is hashed before being used as a key — we don’t store it in readable form | The current browser tab session |
| Unsaved snapshot | Session storage (verdly:snapshot-draft:*) | Keeps figures you have typed but not yet saved, so a reload or an accidental navigation doesn’t lose them. Contains only the values you changed and any note you wrote — never a copy of your saved data | The current browser tab session |
| Signup agreement record | Session storage (verdly.signup.legalConsents) | Records which versions of these policies you agreed to during signup, so we can store that against your account when it is created | Cleared when signup completes |
| Upgrade intent | Session storage (verdly.upgrade.intent) | Remembers that you were heading to the upgrade page when you were asked to sign in, so you are returned there afterwards | The current browser tab session |
3.2 Preferences
These remember UI settings you’ve explicitly turned on. They contain no personal data, are never transmitted to third parties, and are scoped to your browser on the current device.
| Item | Where it’s stored | Purpose | Lifetime |
|---|---|---|---|
| AI Insights opt-in | Local storage (insights_enabled) | Remembers whether you’ve enabled AI Insights | Persistent until you clear browser data |
| Theme | Local storage (dark_mode) | Remembers whether you prefer light or dark mode | Persistent until you clear browser data |
| Dashboard layout | Local storage (dashboard.*) | Remembers dashboard toggles you’ve set, such as whether milestones are visible | Persistent until you clear browser data |
We treat these as strictly necessary on the basis that each one only exists because you actively flipped a toggle to enable it. If you’d rather not have them set, you can simply leave the relevant settings at their defaults.
3.3 Error and performance monitoring — nothing retained
Error and performance monitoring runs for everyone using the app, and retains nothing on your device.
Faro, the tool we use, can keep a session id in your browser so that several errors can be tied to one visit. We have turned that off. Instead the app generates a random reference when the page loads and holds it in memory only: it groups the errors from that page load, and it is gone when you navigate away or close the tab. No session id is saved.
There is one momentary write, and we list it because this policy is meant to be complete:
| Item | Where it’s stored | Purpose | Lifetime |
|---|---|---|---|
| Storage availability check | Local storage and session storage (__faro_storage_test__) | The monitoring code writes a fixed test value when it loads, to find out whether your browser permits storage at all, then deletes it. The value is the same for everyone and says nothing about you | Deleted immediately, in the same moment it is written |
We do send technical details about faults to Grafana (see section 5.3): the type of error and the place in our code it happened, the page you were on, your browser and operating system, and page-load timings. We do not send the error’s own text — error messages can quote back what you typed, so we replace each one with the location in our code instead. Your figures, asset names, email address and name are removed in your browser before anything is sent, and web addresses are stripped of anything after the ?.
There is no setting that stops this. Section 2 describes what you can do if you would rather it did not run at all.
4. What we store on verdly.io (marketing site)
Nothing.
The Verdly marketing site sets no cookies, writes to no local or session storage, and loads no analytics, advertising, or tracking scripts of any kind.
5. Third-party services we use
5.1 Cloudflare
We use Cloudflare as our CDN and security layer. Cloudflare may set a small number of cookies on verdly.io and app.verdly.io to protect the site from abuse:
| Cookie | Purpose | Lifetime |
|---|---|---|
__cf_bm | Distinguishes legitimate visitors from automated bots | ~30 minutes, rolling |
_cfuvid | Helps Cloudflare’s rate-limiting and bot-management features work correctly | Browser session |
cf_clearance | Set only if you’ve successfully completed a Cloudflare security challenge | Up to 1 year |
These are classified by Cloudflare as strictly necessary for the security of the service. You can read Cloudflare’s documentation on these cookies for more detail.
5.2 AWS Cognito
We use AWS Cognito for authentication. The authentication tokens listed in section 3.1 are issued by Cognito and stored in your browser’s local storage by the Cognito SDK. They are not transmitted to anyone other than Verdly’s own servers.
5.3 Grafana Cloud (Faro)
We use Grafana Faro to record errors and page performance. The Faro SDK runs in your browser and sends the technical details described in section 3.3 to Grafana Cloud’s United Kingdom (London) region. As set out there, it retains nothing on your device.
Grafana acts as our processor: they may only use this data to provide the monitoring service to us, and we retain it for 14 days. Grafana Faro is a monitoring tool, not an advertising or audience product — it does not track you across other websites and sets no advertising identifiers.
6. Managing what’s stored
You can clear everything Verdly has stored in your browser at any time. The exact steps depend on your browser, but in general:
- Chrome / Edge: Settings → Privacy and security → Clear browsing data → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
- Safari (macOS): Safari → Settings → Privacy → Manage Website Data
- Safari (iOS): Settings → Safari → Advanced → Website Data
If you clear Verdly’s stored data, you’ll be signed out, any in-progress onboarding draft will be lost, and your preferences will reset to their defaults. Your Verdly account and all the financial data you’ve saved are unaffected — those live on our servers and are accessed separately through your account.
You can also use your browser’s developer tools (Application tab in Chrome / Edge, Storage tab in Firefox) to inspect or remove individual entries.
7. Changes to this policy
If we add new items to what we store, we’ll update this policy before setting anything new.
8. Contact
If you have questions about this policy, contact us at [email protected].