Cookie Policy

access_token

Access token (JWT) that keeps you signed in. It is an httpOnly cookie: the page's code cannot read it

First party (InbestPlanners) · Cookie · 30 minutes

refresh_token

Refresh token: renews your session without asking you to sign in again. It is an httpOnly cookie. Each renewal issues a new one with a fresh 30 days, so it only expires after 30 days without using the site

First party (InbestPlanners) · Cookie · 30 days from last use (renewed with each use)

auth-storage

Authentication state (Zustand persist): whether there is a session and a copy of your account profile as the server returns it (identifier, email address, username, sign-in provider, plan and subscription status with its trial, start, end and pending-change dates, email and alert preferences, selected markets, language, whether you take part in the League, whether the account is verified, has a password or is an administrator, and sign-up and last sign-in dates), to draw the header before asking the server. It holds no passwords, tokens or payment details. Emptied on sign-out

First party (InbestPlanners) · Local storage (localStorage) · No automatic expiry (browser local storage): kept until you clear it

cookie_consent, cookie_preferences

Your cookie choice (accept, reject or custom), the categories you accepted and the date you chose. The choice is valid for 24 months: after that it is no longer applied and the banner asks you again

First party (InbestPlanners) · Local storage (localStorage) · 24 months

cookie_session_id

Random, persistent pseudonymous identifier stored with the record of your cookie choice on our server when you are not signed in, so we can show what you chose and when (if you are signed in, the record is linked to your account instead). It contains no data about you and is not used to track you on other sites

First party (InbestPlanners) · Local storage (localStorage) · No automatic expiry (browser local storage): kept until you clear it

oauth_allow_create, oauth_locale

Temporary data for signing up with Google: whether the account may be created, and which language to continue in on return

First party (InbestPlanners) · Cookie · 5 minutes

next-auth.session-token

Google sign-in (NextAuth): holds only a one-time code that the browser redeems for the session, and is deleted as soon as it is redeemed; if the exchange never happens, it expires after 30 days. In production it is named __Secure-next-auth.session-token

First party (InbestPlanners) · Cookie · 30 days

next-auth.csrf-token, next-auth.callback-url

Google sign-in (NextAuth): protection against forged requests (CSRF) and the page to return to after signing in. In production they are named __Host-next-auth.csrf-token and __Secure-next-auth.callback-url

First party (InbestPlanners) · Cookie · Session

next-auth.state, next-auth.pkce.code_verifier

Google sign-in (NextAuth): OAuth protocol security checks (state and PKCE) while you return from Google. In production they carry the __Secure- prefix

First party (InbestPlanners) · Cookie · 15 minutes

checkout_intent

Remembers the plan you were subscribing to if signup sends you to log in before finishing

First party (InbestPlanners) · Local storage (localStorage) · 24 hours

pending_plan

Remembers, for this browser session only, the plan you chose when signing up, to take you to its payment

First party (InbestPlanners) · Session storage (sessionStorage) · Session

ui-theme

Your light or dark theme preference

First party (InbestPlanners) · Local storage (localStorage) · No automatic expiry (browser local storage): kept until you clear it

__cf_bm (challenges.cloudflare.com)

Cloudflare Turnstile: checks that whoever submits the sign-up, newsletter or password-reset form is a person

Third party (Cloudflare) · Cookie · 30 minutes

onboarding_active_step

Initial tour progress: the step you left it at, so it resumes from there

First party (InbestPlanners) · Local storage (localStorage) · No automatic expiry (browser local storage): kept until you clear it

data-stale-banner-dismissed

Notices you have dismissed, for this browser session only

First party (InbestPlanners) · Session storage (sessionStorage) · Session

ip-notice-seen:*

Notices you have dismissed, for this browser session only

First party (InbestPlanners) · Session storage (sessionStorage) · Session

_ga, _ga_<ID> (Google Analytics)

Google Analytics (analytics, only with your consent): pseudonymous identifier to count visits and measure, in aggregate, how the site is used. Set by Google on our domain

Third party (Google) · Cookie · 13 months (390 days), renewed on each visit

_gcl_au, _gcl_aw (Google Ads)

Google Ads (ad measurement, only with your consent): keeps the identifier of a click on one of our Google ads to know whether that visit ends in a sign-up, a trial or a purchase. Set by Google on our domain; not used to personalise ads

Third party (Google) · Cookie · 90 days

_fbp, _fbc (Meta)

Meta pixel (ad measurement, only with your consent): _fbp is a pseudonymous browser identifier and _fbc keeps the click identifier if you arrive from one of our Instagram or Facebook ads, to know whether that visit ends in a sign-up, a trial or a purchase. Set by the Meta pixel on our domain; we do not use them to personalise ads, and Meta processes that data under its own policy

Third party (Meta) · Cookie · 90 days