Cookie settings
Fincraft's own cookies are functional — they keep you signed in and protect the forms you submit. Google Analytics counts visits to the public pages while you are signed out. There is no advertising.
Last updated 1 November 2026
Your settings
| Essential Signing in and protecting your forms. |
Always on | Needed for the service to work; they cannot be switched off. |
| Keep me signed in The one optional cookie. |
Off until you tick it | Set only if you tick “Keep me signed in” when you sign in. |
| Analytics Google Analytics visit counts. |
Public pages only | Counts visits to the front page, sign-in and these policy pages while you are signed out. Nothing is sent once you sign in, and your financial records never are. Block it in your browser or with Google's opt-out add-on if you prefer. |
| Advertising | Not used | Fincraft sets no advertising cookies and shows no ads. |
Every cookie that can be set
| Name | Purpose | Lasts | Type |
|---|---|---|---|
fincraft_session |
Keeps you signed in as you move between pages. It holds a random identifier only — no personal data is stored in the cookie itself. | 120 minutes of inactivity, or until you sign out | Essential |
XSRF-TOKEN |
Protects against cross-site request forgery: it lets the server verify that a form submission came from a page it served, not from another site. | Same as the session cookie | Essential |
remember_web_* |
Set only if you tick "Keep me signed in". Lets you return without signing in again. | Up to 5 years, or until you sign out | Optional |
fc_device |
Recognises this browser when you sign in, so a sign-in from a device you have never used can be emailed to you. It holds a random identifier only. | 2 years, renewed each time you sign in | Essential |
_ga, _ga_* |
Set by Google Analytics. Distinguishes one visitor from another so visits can be counted. | Up to 2 years | Optional |
Google Analytics
Fincraft uses Google Analytics on its public pages — the front page, sign-in and
registration, and these policy pages — to count visits, so it can be improved. Google sets
the _ga cookies listed above and receives which of those pages you opened and
general details about your browser. The tag is not loaded at all once you are signed in, so
no screen inside the application, and nothing you keep in Fincraft, ever reaches Google.
The one optional cookie of Fincraft's own is the “Keep me signed in” cookie, and it is only ever set if you tick that box yourself. That tick is the consent.
Your controls
- Do not use “Keep me signed in”. Leave the box unticked and no optional cookie is ever created.
- Sign out. This clears the session cookie and invalidates the remember-me cookie immediately.
- Block or clear them in your browser. Nothing here objects. Be aware that blocking the session and CSRF cookies makes signing in impossible — not as a punishment, but because those cookies are the mechanism that keeps you signed in.
Other local storage
The application does not use localStorage, sessionStorage or IndexedDB.
Your theme and reporting-currency preferences are stored against your account in the database,
not in your browser, which is why they follow you between devices.
Third parties
Only Google Analytics. There is no content delivery network, no web font host, no embedded media and no error-reporting service. Every other asset on every page is served by this installation.