Cookie Policy

Effective date: to be set on adoption.

1. What This Policy Covers

This Cookie Policy explains how Your Pocket Planner uses cookies and similar technologies on yourpocketplanner.ca, app.yourpocketplanner.ca, and related subdomains (the "Service"). It describes what these technologies are, what we use them for, who places them, how long they last, and how you can control them.

2. The Short Version

• We use a small number of cookies that are strictly necessary to keep you signed in and the Service working.
• We do not use advertising cookies. We do not allow third-party advertising networks on our website. We do not use cookies to follow you around the internet.
• We use PostHog for analytics. It sets a first-party cookie so we can measure how the Service is used. We do not show you ads or follow you across other websites, we run it in an identified-only mode with session recording turned off, and the data is hosted in the European Union. It is described in the list below.
• You can disable cookies in your browser. Disabling strictly necessary cookies will prevent you from signing in or using parts of the Service.

3. What Are Cookies and Similar Technologies?

A "cookie" is a small text file that a website places on your device (computer, phone, tablet) so that the site can remember information about your visit. Cookies are widely used to make websites work, to improve user experience, and to understand how websites are used.

Cookies fall into a few categories.

3.1 By who places them

• First-party cookies are placed by the website you are visiting. Ours are first-party cookies set on the yourpocketplanner.ca domain (or its subdomains).
• Third-party cookies are placed by a domain other than the one you are visiting. We use third-party cookies only where a third-party service provider (for example, our payment processor) sets one as part of delivering a feature you have engaged with.

3.2 By how long they last

• Session cookies last only until you close your browser.
• Persistent cookies remain on your device for a defined period (anywhere from minutes to years) or until you delete them manually.

3.3 By purpose

• Strictly necessary: required for the Service to function. We do not ask for your consent for these because the Service cannot operate without them; you have consented to them by using the Service.
• Functional: remember your preferences (for example, dark mode, language) so you do not have to set them on every visit.
• Analytics: help us understand how the Service is used so we can improve it. We use only privacy-respecting analytics.
• Marketing or advertising: we do NOT use cookies in this category and do not permit third-party advertising trackers on the Service.

3.4 Similar technologies

Where this Policy mentions "cookies," it also includes:

• Local storage and session storage in your browser, which work like cookies but store information on your device for use by a single site.
• Pixels and tags, which are small pieces of code that record a visit (we do not currently use third-party pixels).
• Software development kit (SDK) identifiers, where applicable to a mobile or desktop application (the Service is currently web-based).

4. Cookies and Similar Technologies We Use

The table below describes the cookies and similar technologies we use today. We will update this Policy when this list changes. This list was verified against the application source code on September 10, 2026.

4.1 Strictly necessary

• ypa-auth (authentication session). Domain: .yourpocketplanner.ca (or .yourpocketadvisor.ca where that domain is in use). Purpose: keeps you signed in across yourpocketplanner.ca and its subdomains; the same cookie carries your Supabase authentication session. Lifetime: up to 30 days, refreshed while you use the Service; cleared on sign-out. First-party. SameSite=Lax.
• No other strictly necessary cookies are set. We do not set a separate anti-forgery (CSRF) cookie: sensitive actions are authorized by your signed-in session token rather than by a CSRF cookie. Our hosting provider does not set cookies on the production deployment.

4.2 Functional

• Browser local storage (not a cookie). Purpose: keeps your in-progress plan data, questionnaire answers, and interface state (for example, whether you have already seen the welcome screen) on your device so you do not lose your place between visits. The Service does not currently store a theme preference, a locale preference, or a remember-this-device flag. Lifetime: until you clear your browser data or sign out. First-party; stored only on your device.

4.3 Analytics

• PostHog analytics. A first-party cookie that stores a usage identifier so we can measure how the Service is used and how well the signup process works. We run PostHog in an identified-only mode (a profile is created only for signed-in users) with session recording turned off. Domain: .yourpocketplanner.ca. Lifetime: persistent, up to 12 months. Data residency: European Union.

4.4 Marketing or advertising

None. We do not use advertising cookies, retargeting pixels, or third-party marketing trackers. We will not introduce any without updating this Policy and obtaining your consent in accordance with our Privacy Policy.

4.5 Third-party cookies set through embedded services

• Payment processor checkout (if you initiate a paid action): Stripe, Inc. (United States). Purpose: secure payment processing and fraud prevention. Set by the third party on their domain. Subject to the third party's privacy policy.
• No other embedded service sets cookies through the Service. Customer support is handled internally via email at launch; there is no third-party support widget, and the Service loads no third-party scripts other than the PostHog analytics described above.

5. How We Use the Information from Cookies

We use cookies and similar technologies to:

• Keep you signed in.
• Protect against unauthorized actions on your account.
• Remember your preferences.
• Measure aggregate usage (for example, total visits to a help article) so we can prioritize improvements.

We do not use cookies to:

• Build advertising profiles about you.
• Share information about you with advertisers.
• Track your browsing on websites other than ours.

6. Your Choices and How to Control Cookies

6.1 Cookie banner

For V1, the Service uses a small number of strictly necessary cookies (authentication and, where applicable, anti-forgery and routing) and one first-party analytics cookie set by PostHog, described in section 4.3. Because the analytics cookie is not strictly necessary, the consent approach for it, including whether an informational notice is sufficient or a consent banner is required under PIPEDA and Office of the Privacy Commissioner of Canada guidance, is being confirmed with privacy counsel before public launch. We may surface an informational notice about cookies in the application, and if a banner with granular consent is required it will be deployed accordingly.

6.2 Browser settings

Most browsers let you view, manage, and delete cookies. Common options:

• Block all cookies (this will prevent you from using the Service).
• Block third-party cookies only.
• Delete cookies on browser close.
• Delete specific cookies you no longer want.

See your browser's help pages for instructions. Search terms like "manage cookies in [browser name]" will find current guidance.

6.3 Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" or Global Privacy Control (GPC) signal. Because we do not engage in cross-site tracking or targeted advertising, our handling of personal information does not change based on these signals. We will update this Policy if our practice changes.

6.4 Mobile device controls

If we offer a mobile application in the future, device-level controls (for example, the Apple ATT framework, or Google Advertising ID controls) will be described in the relevant app store listing and in an updated version of this Policy.

7. Updates to This Policy

We will update this Cookie Policy whenever we add, remove, or change the cookies and similar technologies used on the Service. Material changes are communicated as described in our Privacy Policy. The version and effective date are shown at the top of this Policy.

8. Contact Us

For questions about this Cookie Policy, contact our Privacy Officer:

• Email: hello@yourpocketplanner.ca
• Mailing address: to be inserted on adoption (counsel-coordinated)

Escalation to a Canadian privacy regulator is described in our Privacy Policy.

Effective date: TO BE SET ON ADOPTION

DRAFT v0.1 . Authored 2026-05-12 . Pending counsel review.