Cookies & Local Storage Inventory
Last updated: October 2026
GlassFolio uses NO third-party tracking cookies or advertising pixels. All client-side persisted data is managed through the browser local storage under strict cryptographic segmentation; the keys listed below are the only ones written.
Inventory of Storage Keys
| Key Name | Classification | Technical Purpose & Security Lifecycle | Lifespan |
|---|---|---|---|
| gf_vault_header | Strictly Necessary | Stores the PBKDF2 salt, auth verification tag, and passkey PRF metadata. Contains no financial values. | Persistent until user purge |
| glassfolio_* | Strictly Necessary (Encrypted) | AES-256-GCM encrypted financial ledger records (transactions, positions, goals, AI secrets). Only readable with your master key in RAM. | Persistent until user purge |
| gf_public_theme / gf_public_lang | Strictly Necessary (Preferences) | Stores your chosen UI theme (Light, Dark, Midnight) and language preference (EN, FR) across sessions and between glassfolio.dev and app.glassfolio.dev. | Persistent until browser cache clear |
| gf_consent_v1 | Strictly Necessary (Consent State) | Stores your CNIL GDPR analytics consent record and timestamp. | 13 months maximum, then asked again |
| gf_sb_session | Strictly Necessary (Session) | Keeps your cloud-mode sign-in session (Supabase tokens) so you do not have to sign in again. Absent in local mode. | Until sign-out or session expiry |
| gf_oauth_pkce_verifier / gf_oauth_pending / gf_google_oidc_ceremony | Strictly Necessary (Security) | Temporary security values (PKCE verifier, OIDC ceremony state, CSRF marker) during Google sign-in. | Removed when sign-in completes |
| gf_price_cache / gf_fx_rates_cache / gf_historical_price_cache / glassfolio_price_cache | Strictly Necessary (Public cache) | Locally caches public prices and exchange rates to limit network calls. Holds no personal data. | Minutes to hours, then refreshed |
| gf_asset_class_cache / gf_asset_lookup | Strictly Necessary (Public cache & Preferences) | Remembers on this device what kind of asset a symbol or ISIN is (stock, ETF, crypto) after a lookup, and your choice to switch that lookup off in Settings. Holds only public market identifiers. | Up to 30 days, then refreshed; the choice stays until you change it |
| gf_sidebar_collapsed / glassfolio_manual_price_history / gf_manual_price_history | Strictly Necessary (Preferences & Data) | Sidebar state (local) and manual price history (end-to-end encrypted inside your vault). | Persistent until account deletion or cache clearing |
| gf_passkey_rp_id | Strictly Necessary (Security) | Remembers the domain (RP ID) your passkeys are bound to so the vault can be unlocked while locked. Public deployment metadata, no personal data. | Until account deletion or cache clearing |
| gf_chunk_reload_at | Strictly Necessary (Session) | Time of the last automatic reload after a GlassFolio update, so a page that cannot load is reloaded only once instead of in a loop. Contains no personal data. | Until the tab is closed |
Interactive Analytics Consent Manager
Current Consent Status:No Choice Recorded Yet
Strictly necessary
Sign-in, encrypted data, language and theme. GlassFolio can't work without them.
Audience measurement
Anonymous page visits through Vercel Web Analytics, to see which pages are useful. No advertising, off until you turn it on.