Cookie Notice
Last updated: August 31, 2026
1. What this notice covers
This notice explains the cookies and similar browser storage used on the BorderFolio marketing site (borderfolio.app) and inside the application (app.borderfolio.app). It supplements our Privacy Policy, which describes the wider processing of personal information.
"Cookies" here means cookies proper as well as equivalent technologies that store data in your browser — localStorage and sessionStorage. They are listed together below because they raise the same question for you: what is kept on your device, and why.
2. Your choice
Analytics is off until you turn it on. When you first visit the site, a bar appears asking whether you accept the analytics cookie. Nothing is sent to our analytics provider, and no analytics cookie is written, unless you press Accept.
You can change your answer at any time using the Cookie settings link in the footer of every page. Declining removes the analytics cookie and stops the collection.
If your browser or extension sends a Global Privacy Control signal, we treat that as a decline automatically and do not show you the bar at all.
The strictly necessary items in the table below cannot be switched off: without them you cannot stay signed in or use the application, and they are never used to profile you.
3. Cookies and storage on borderfolio.app (this site)
| Name | Type | Purpose | Retention |
|---|---|---|---|
| bf_ph | Cookie — analytics (optional) |
Set by PostHog once you accept. Holds a random identifier so that repeat visits and the steps you take inside the application can be counted as one journey rather than several strangers. It is scoped to .borderfolio.app so the same identifier is recognised on the application subdomain. It contains no name, email, or portfolio data. |
12 months |
| bf_consent | Cookie — strictly necessary | Records whether you accepted or declined analytics, so that we honour your answer and do not ask again on every page. It is scoped to .borderfolio.app so that one answer covers both this site and the application; it holds nothing but the words “granted” or “declined”. |
6 months, after which we ask again |
| bf_partner | Cookie — strictly necessary | Set only if you arrived through a partner’s referral link (an address carrying ?partner=). It holds that partner’s short label and the moment you followed the link — nothing about you, and nothing about what you read. Its single purpose is to pay the author who referred you if the visit later becomes a subscription: the label is sent to us when you register, and the partner’s affiliate identifier is passed to Freemius when you pay. It is scoped to .borderfolio.app because the referral happens on this site and the purchase happens on the application subdomain. |
60 days from the click |
| bf_attribution | sessionStorage — strictly necessary | Holds the campaign parameters (utm_source, utm_campaign and similar) and the referring site from the page you first landed on, plus that page's path. It stays on your device only; it is sent to our analytics provider if — and only if — you accept analytics, and it is erased if you decline. It exists because that information is destroyed by your own navigation as soon as you open a second page, and without it we cannot tell which article or directory brought you here. |
Until the browser tab is closed |
4. Cookies and storage on app.borderfolio.app (the application)
| Name | Type | Purpose | Retention |
|---|---|---|---|
| access_token, refresh_token | localStorage — strictly necessary | Keep you signed in between page loads and let the session be renewed without asking for your password again. Removed when you sign out. | Until sign-out; the refresh token expires after 30 days |
| portfolio_id | localStorage — strictly necessary | Remembers which of your portfolios you were last looking at, so the dashboard opens where you left it. | Until sign-out |
| bf_onboarding, bf_goal, bf_add_portfolio, bf_check_contributions | localStorage — strictly necessary | Hold the partly completed state of the setup flows (the statement you are importing, the goal you are setting) so that a reload does not lose the work in progress. | Until the flow is completed or abandoned |
| bf_disclaimer_ack, bf_celebrated_*, bf_celebration, bf_pending_celebration, bf_celebration_pending | localStorage — strictly necessary | Remember that you have already dismissed the disclaimer and already been shown a given milestone, so the same notice is not repeated at every visit. | Until you clear your browser storage |
| bf_seen_notif_ids, bf_processed_notif_ids | localStorage — strictly necessary | Record which in-app notifications you have already seen, and which ones the application has already acted on, so that a notice you have read is not shown as new again and a finished import is not announced to you twice. They hold notification identifiers only, no content. | Until you clear your browser storage |
| bf_pro_override_until | localStorage — strictly necessary | Briefly unlocks Pro features in the interface immediately after a successful payment, while the confirmation from the payment provider is still being processed. | Minutes |
| bf_ph | Cookie — analytics (optional) |
The same analytics cookie described in section 3, shared with this site. Set only if you accepted analytics. | 12 months |
5. Third parties that may set cookies
| Provider | Where | What it is for |
|---|---|---|
| PostHog (EU Cloud) | Both | Product analytics. Runs on PostHog's European instance, so the data is stored in the EU. We have deliberately switched off session recording and automatic capture of page content, which means the contents of your portfolio — values, tickers, dividend amounts — are not sent to PostHog. Only the named events described in section 6 are. |
| Cloudflare | Both | Security and bot protection, including the Turnstile challenge on the sign-up and sign-in forms. These are strictly necessary and are not used for analytics or advertising. |
| Freemius | Application | Payment and subscription checkout. Cookies are set by Freemius in its own checkout window when you begin an upgrade, under its own privacy policy. |
6. What analytics actually records
If you accept analytics, we record page views and a small, fixed set of named events describing progress through the product: an account being created, a portfolio being added, a broker statement being imported successfully, an analysis page being opened for the first time, and a subscription being started. Each is stored with the campaign and referrer information from section 3.
We do this to answer one question we otherwise cannot answer: which channel brings people who actually get value from BorderFolio, and at which step people give up. It is not used to build an advertising profile, and the data is not shared with advertisers or data brokers.
Once you are signed in, these events are linked to your account identifier so that the steps form a single journey. They are not linked to the contents of your portfolio.
7. Managing cookies in your browser
Besides the choice offered on this site, most browsers let you block or delete cookies and clear site storage from their settings. Blocking the strictly necessary items will prevent you from staying signed in and will break parts of the application. Instructions differ between browsers; look for "Cookies and site data" or "Privacy" in your browser's settings.
8. Changes to this notice
If we add or remove a cookie, or change what analytics records, we will update this page and the date at the top of it. Where the change requires it, we will ask for your consent again.
9. Contact
Questions about this notice, or a request to exercise your data protection rights? Email admin@borderfolio.app. This notice should be read together with our Privacy Policy and Terms of Use.