Cookies and storage list
Here is the complete list of cookies, localStorage, and sessionStorage that Eleev writes to your device, grouped by consent category (Law 25 §8.2 and PIPEDA Principle 4.3).
Your choices
No choice recorded.
Necessary
Always on. Required for basic functionality.
| Name | Storage | Purpose | Retention |
|---|---|---|---|
| eleev-consent-v1 | localStorage | Stores your cookie consent choice. Required for the consent system itself. | 12 months |
| theme | localStorage | Remembers your theme (Linen / Azure / Obsidian / Forest). | Until cleared |
| language | localStorage | Remembers your language (EN / FR). | Until cleared |
| font | localStorage | Remembers the font you chose. | Until cleared |
| sb-* (Supabase auth) | localStorage | Authentication session for signed-in users (Supabase JWT). Without it you can't stay logged in. | Session + refresh token TTL |
| cf_clearance | Cookie | Set by Cloudflare, which protects the website from bots, after an invisible check that runs when a page loads. It holds the result of that check. On the website only, never in the Android or desktop apps. | 30 minutes (Cloudflare default) |
| eleev_stay_signed_in | localStorage | Remembers your choice for “Remember this device” on the sign-in form. When off, this device signs out once it has gone unused for longer than the time shown there, whether you left the page open or closed it. | Until cleared |
| eleev_last_seen_at | localStorage | Used only when “Remember this device” is off: records when you last used this device, so it can tell how long you were away. Cleared every time you return. | Cleared on every return |
| eleev_app_lock_enabled | localStorage | Whether you turned on “Lock the app” in Settings (Android app). Kept on this device after you sign out, so signing out is not a way to switch the lock off. | Until cleared |
| eleev_widget_masked | localStorage | Your choice under “Hide the amounts” for the home-screen widget (Android app). Written only once you use that switch; before that, the widget follows the app lock. | Until cleared |
| eleev_haptics_enabled | localStorage | Whether “Touch feedback” is on in Settings (Android app). On by default; kept on this device after you sign out. | Until cleared |
| eleev_held:* (held copy) | localStorage | When this device is signed out from another device (or your session ends on its own), your portfolio and profile values are moved here, hidden from anyone using the device as a guest, and moved back when you sign in again. Hidden, not erased: the copy is removed when a different account signs in on this device or when you clear the site data. | Until you sign in again, another account signs in, or the site data is cleared |
| eleev_held_meta | localStorage | Which account the held copy belongs to (a short hash, not your identifier), when it was held, and why — so the sign-in dialog can say what happened and only the same account gets the copy back. | Same as the held copy |
| toolsess_<session>_* (per tool) | sessionStorage | Keeps your tool inputs when you switch between tools and come back in the same browser session. Tied to the account you are signed in with, so another account cannot load them. Without an account there is nothing to tie them to, so two people sharing the same open tab can see each other's. Auto-cleared when you close the tab. | Browser tab session |
| eleev_ota_platform | localStorage | Capacitor (native APK) runtime platform fingerprint, used by the OTA update system to fetch the correct bundle for your device. | Until cleared |
Preferences
Optional. Enables tool input autosave, UI state memory and the “Last used” mark when you sign in.
| Name | Storage | Purpose | Retention |
|---|---|---|---|
| tool_<session>_* (per tool) | localStorage | Autosaves your tool inputs across sessions so you don't re-enter them every visit. Each key is tied to the account that entered them, so another account on this browser cannot load them. Without an account they are kept under a shared anonymous key, which is why they are deleted after 24 hours. Only fires when you opt in to Preferences. | 1 year signed in · 24 hours without an account, then deleted |
| finance_cell_* | localStorage | Portfolio column visibility, ordering, and table view preferences. | Until cleared |
| finance_shared_profile | localStorage | Shared financial profile (age, income, region) used to pre-fill multiple tools so you don't re-enter common inputs. Read-gated by your preferences choice. | Until cleared |
| eleev-sidebar-prefs-v1 | localStorage | Sidebar collapsed state and section ordering. Currently writes even when preferences=off (Phase 5 will review granular gating). | Until cleared |
| eleev_last_signin_method | localStorage | Which way you last signed in on this device: Google, password or email link. The sign-in window marks it “Last used”. It keeps the method only, never your email address, and is only written when you opt in to Preferences. | Until you turn off Preferences or delete your account |
| eleev_session_count | localStorage | Counts your sessions to pace upgrade prompts so you're not nagged every visit. Currently writes even when preferences=off (Phase 5 will review). | Until cleared |
| eleev_onboarding_done | localStorage | Tracks whether you completed the welcome flow so we don't re-show it. | Until cleared |
Analytics
Optional. Anonymous usage statistics via PostHog. No financial data.
| Name | Storage | Purpose | Retention |
|---|---|---|---|
| Visit source | In memory only | When you arrive through a link we tagged — an ad, a newsletter, a partner site — that tag is read from the address bar and kept in the page's memory while you decide about cookies. Decline Analytics and it is thrown away: nothing is written to your device. Accept and it goes to PostHog, so we can tell which campaigns actually bring people here. We keep the first source we ever see for you, not the most recent one. | Until the tab closes — or immediately, if you decline |
| ph_* (PostHog) | Cookie | Anonymous usage analytics (page views, feature use, error reports). No financial data sent. Only fires when you opt in to Analytics. | 12 months (PostHog default) |
| posthog (session replay) | localStorage | Session recording for UX debugging. All financial values are masked (data-ph-mask). Only fires when you opt in to Analytics. | 30 days |
For more details on personal data processing, see our privacy policy.