Cookie Policy
Last updated: October 9, 2026
This Cookie Policy explains what cookies and similar technologies we use, why we use them, and how you can control them. It complements our Privacy Policy and reflects the EU ePrivacy rules and Polish Telecommunications Law (art. 173).
Cookie preferences
Review or withdraw your cookie consent at any time.
1What Are Cookies?
Cookies are small text files stored on your device when you visit a website. Similar technologies (such as local storage) work in comparable ways. They help us keep you logged in, remember your preferences, keep the service secure, and, only with your consent, understand usage.
2Consent
We set non-essential cookies (analytics, marketing) only after you give consent, and never before. You can accept all, reject all optional cookies, or choose per category. You can withdraw or change your consent at any time, just as easily as you gave it, using the "Manage cookies" option. Essential cookies do not require consent because they are necessary to provide the service you request.
3Essential Cookies and Storage (Always Active)
These are required to run FinSpot and cannot be disabled: • __Host-access_token - your sign-in token; kept for the lifetime of the access token (15 minutes if our server does not report one). • __Host-refresh_token - renews your session so you stay signed in; kept for 30 days. Both are set by FinSpot's own server and deleted when you sign out. They are HttpOnly (page scripts cannot read them), Secure (sent over HTTPS only) and SameSite=Lax. Your sign-in tokens are never stored in local storage. We set no other cookies. Your browser's local storage keeps your cookie choices, language, currency and theme, dashboard layout, saved views, setup checklist and onboarding progress, entitlement suggestions you hid, and - after you withdraw analytics consent - a flag (umami.disabled) that keeps analytics switched off. Session storage briefly keeps salary calculator inputs, content shared to FinSpot, an invitation link or a referral code until it is used or you close the tab. Legal basis: our legitimate interest in providing a secure, functioning service; this storage is strictly necessary for features you use, so no consent is required.
4Optional Cookies
Analytics: we use self-hosted Umami analytics, which is cookieless and loads only after you opt in to the analytics category; the data stays on our own infrastructure. With the same consent, we keep a short record of your first visit (campaign parameters, first page and referring site) in your browser's local storage, so a later signup can be attributed to it. If you withdraw consent, the tracker stops sending data immediately, including in the page you have open, and is not loaded again unless you opt in again; the first-visit record is deleted from your browser. Marketing: we do not use any marketing or advertising cookies or trackers; if we introduce them, they will only be set after you opt in, and this policy will be updated.
5Third-Party Cookies
To pay for a plan you are redirected to Stripe's hosted checkout page, where Stripe may set cookies on its own domain that are needed to process the transaction securely and prevent fraud. When bot protection is enabled, the sign-in, registration and password-reset forms show a Cloudflare Turnstile check in a frame served by Cloudflare, which collects browser signals solely to detect bots. These providers' own privacy and cookie policies apply, and we do not control cookies they set on their own domains.
6Managing Cookies
You can manage cookies in three ways: • Use the "Manage cookies" button on this page, "Cookie Settings" in the footer, or "Cookie preferences" in Settings to review or withdraw consent. • Adjust the cookie banner that appears on your first visit. • Configure your browser to block or delete cookies. Blocking essential cookies prevents you from signing in.
7Changes to this Cookie Policy
We may update this Cookie Policy to reflect changes in the cookies we use or legal requirements. Material changes will be notified, and the "last updated" date above will change. Where required, we will ask for your consent again.