Cookies Policy

Last updated: 18 October 2026

Proofolio keeps cookies and local storage to a minimum. Here is exactly what is used and why.

Strictly necessary

• proofolio_refresh — an HttpOnly, SameSite=Strict cookie scoped to the auth API, used to keep you signed in securely (refresh tokens rotate on every use). Without it, logging in does not work. Expires after 7 days.
• Local storage — your short-lived access token, your display name, and small UI preferences (for example, a light/dark choice) so the app remembers your settings.

Analytics

We use PostHog to understand feature usage and errors. It stores its own identifiers in cookies/local storage to count visits and sessions. Where session recording is enabled, it records interaction data (never typed passwords — those fields are masked from recording).

Managing cookies

You can clear cookies and local storage through your browser at any time. Blocking the strictly necessary cookie will sign you out and prevent logging in. Analytics identifiers can be cleared the same way; clearing them resets your usage stats but does not affect your account.

Contact

Questions: security@proofolio.tech.