Legal
Cookie Policy
Last updated 13 August 2026
This lists the cookies and similar technologies TestFi uses. It is part of the Privacy Policy.
01What we set
| Cookie | What it does | Lasts | Category |
|---|---|---|---|
| Supabase auth tokens | Keeps you signed in. Without these you cannot use an account | Session and refresh, up to 1 year | Strictly necessary |
| x-profile-cache | Remembers your role and whether you finished onboarding, so pages load without a database lookup each time | 4 hours | Strictly necessary |
| testfi_consent | Remembers your answer to the banner, so we stop asking | 1 year | Strictly necessary |
| testfi_utm (browser storage) | Records which campaign or referring site brought you to TestFi, so we can tell which marketing is worth continuing | Until you clear your browser storage | Analytics, needs consent |
| Vercel Analytics | Counts page views and referrers in aggregate. No cross-site tracking, no advertising profiles | Session | Analytics, needs consent |
| Google Ads tag | Tells Google Ads that a signup or payment followed one of our ads. Only loaded where advertising runs | Up to 2 years | Advertising, needs consent |
| Vercel Speed Insights | Measures how fast pages load. Times the page, not the person, and carries no identifier we can tie to you | Session | Strictly necessary |
| Stripe | Fraud prevention on the checkout page, set by Stripe when you pay | Up to 1 year | Strictly necessary for payment |
02Strictly necessary cookies
These make the platform work: signing in, staying signed in, and paying. They do not track you across other websites and we do not ask for consent to set them, because without them there is no service. Blocking them in your browser will break sign-in.
03Analytics and attribution
These tell us how many people visited and where they came from, which is how we work out whether any marketing is worth continuing. They are aggregate measurements. We do not use them to build an advertising profile, we do not share them with ad networks, and we do not sell them.
04Your choices
You can delete or block cookies in your browser settings at any time. Strictly necessary cookies will break sign-in if you block them; blocking the analytics ones costs you nothing.
If you are in the EEA, the UK, Switzerland or Türkiye, we ask before storing anything non-essential. Nothing in the analytics or advertising rows above loads until you answer, and refusing is one button of the same size as accepting. There is no way to dismiss the banner without answering, because closing a box is not agreement.
To change your mind, clear the testfi_consent cookie in your browser and the question comes back. If that is awkward, email privacy@testfi.app and we will handle it.
05Changes
When we add or remove a cookie we update this table and the date at the top. Material changes are announced in the product.