Home

    Cookie Policy

    Last Updated: September 22, 2026

    This Cookie Policy explains how Pocket Runway ("we," "us," or "our") uses cookies and similar tracking technologies when you visit pocketrunway.com or use our Service.

    By using the Service, you consent to the use of cookies as described in this policy.

    1. What Are Cookies

    Cookies are small text files stored on your device when you visit a website. They allow the website to recognize your device and remember information about your visit, such as your preferences and login status.

    We also use local storage, which works similarly to cookies but stores data within your browser rather than sending it back to the server with each request.

    2. Cookies and Local Storage We Use

    Essential

    These are required for the Service to function and cannot be disabled.

    • Authentication tokens (JWT): stored in browser local storage to keep you signed in across sessions. Without these, you would need to log in on every page load.
    • CSRF protection tokens: used to protect against cross-site request forgery attacks.

    UI State

    These are lightweight flags stored in local storage that remember your interface preferences. They contain no personal or financial information.

    • PWA install prompt state: remembers whether you have dismissed the "Install Pocket Runway" banner.
    • Visit count: tracks how many times you have visited so the install banner is shown at an appropriate time.
    • Email verification banner dismissal: remembers if you have dismissed the email verification reminder.

    Analytics and Performance

    • Google Analytics: we use Google Analytics 4, provided by Google LLC, to measure how the website and the Service are used. Google acts as our service provider for this. The Google Analytics tag runs only on pocketrunway.com and www.pocketrunway.com — it is not loaded in our mobile app builds or in development environments.

      Google Analytics sets first-party cookies on your device, named _ga and _ga_<container ID>, which by default expire two years after your most recent visit. These cookies hold a randomly generated identifier used to recognize a returning browser and to group page views into a single visit. They do not contain your name, email address, or any of your financial information.

      Through these cookies, Google Analytics collects: the page or screen you are viewing, the page that referred you, approximate location derived from your IP address, your browser and device type, and a small set of events we send explicitly — page views, sign-ups, logins, clicks on our sign-up buttons, and starting a subscription checkout. We use this to understand which pages people find, where they leave, and whether the Service is working for new users. We do not send your budget, balances, transactions, or any other content of your account to Google Analytics, and query strings on in-app links (which can carry password-reset and sign-in tokens) are removed before a page view is recorded.

      We do not use Google Analytics for advertising, remarketing, or cross-site tracking, and we do not link it to any Google advertising product. Google's handling of this data is described in Google's Privacy Policy and in How Google uses information from sites or apps that use our services.

      Turning it off: you can opt this browser out permanently by visiting pocketrunway.com/?ga_opt_out=1. That stores a single flag (ga_opt_out) in your browser's local storage and stops the analytics tag from loading on this device; visiting with ?ga_opt_out=0 turns it back on. You can also block cookies in your browser (see section 3) or install Google's official opt-out browser add-on.

    • Our own page-view counting: separately from Google Analytics, we count page views on our own servers. This sets no cookie and stores nothing on your device. For each view we keep the page path (query strings removed), the referring website's hostname, whether the visitor was a crawler, and a one-way hash of your IP address and user agent that is re-salted every day — so it can count distinct visitors within a day and cannot recognize you across days or be reversed to your IP address, which we never store. It is not linked to your account. These records are deleted after 90 days.

      Turning it off: the same ga_opt_out flag described above also switches off the in-app half of this counting. Our own administrators can also set a cookie named pr_no_analytics on their personal browsers, which stops their visits being counted at all; it holds no identifier and is only ever set on a signed-in administrator's own device. Because the other half runs on our server when a page is requested, and involves no cookie or device storage, it cannot be switched off from your browser; if you would like your data excluded, contact us and we will remove it.

    • Campaign link attribution (pr_first_touch): when you arrive through one of our own campaign links (an address beginning pocketrunway.com/go/), we set a first-party cookie named pr_first_touch. It holds only the short name of that link (for example threads-g12) and the time you clicked it, signed so it cannot be altered. It is only ever read by our own servers: scripts running on the page cannot see it. It is set only by our own links: it is never set by, or shared with, another website. If you click a second campaign link while it is present, nothing changes: we keep the first one. It expires after 30 days.

      If you create an account while it is present, we store that one link name and click time on your account, so we can see which of our own marketing links led to sign-ups and which ones do not. The cookie is then deleted. It records no browsing history, no other pages you visited, and nothing about your finances. If you sign in to an existing account instead, or are already signed in when you click the link, the cookie is deleted and nothing is added to that account. We do not use it for advertising, and we do not share it or sell it.

      Turning it off: with the same ga_opt_out flag described above set, each page load asks our server to delete this cookie, and a sign-up from that browser tells our server not to record a link, so it is never stored on an account. You can also delete or block it in your browser (see section 3).

    • Sentry session tracking: Sentry, our error monitoring provider, may use local storage to associate errors with specific sessions. We strip personally identifiable information from error reports before transmission.

    Third-Party

    When you interact with embedded third-party services, those services may set their own cookies. We do not control these cookies.

    • Stripe: sets cookies during checkout for fraud prevention and payment processing.
    • Plaid: sets cookies during bank account linking.

    3. Managing Cookies

    Most web browsers allow you to control cookies through their settings. You can:

    • Block all cookies
    • Block third-party cookies only
    • Delete existing cookies
    • Set preferences for specific websites

    Note: if you block essential cookies, the Service may not function correctly. Specifically, you will not be able to remain logged in.

    Browser-specific instructions:

    • Safari: Preferences → Privacy → Cookies and website data
    • Chrome: Settings → Privacy and security → Cookies
    • Firefox: Settings → Privacy & Security → Cookies and Site Data
    • Edge: Settings → Cookies and site permissions

    4. Do Not Track

    Some browsers offer a "Do Not Track" (DNT) signal. Because there is no industry-standard interpretation of DNT signals, we do not currently respond to DNT signals. We do not track users for advertising purposes regardless of DNT settings.

    5. Changes to This Policy

    We may update this Cookie Policy from time to time. Material changes will be communicated through the Service or via email. The "Last Updated" date at the top of this policy indicates the most recent revision.

    6. Contact

    If you have questions about this Cookie Policy, contact us at:

    Email: support@pocketrunway.com