Cookie policy
The cookies we set, what each one does and how to change your choices. Draft for legal review.
In short
- We use a small number of cookies to make the website work, remember your choices and understand how it is used.
- Strictly necessary cookies are always on. Everything else is off until you say yes.
- You can change your choices at any time from the cookie settings link in the footer.
- The platform uses device and session identifiers for security and analytics, described in our Privacy Policy.
Draft for legal review. Not yet in force.
1. What cookies are
1.1 Cookies are small text files that a website stores on your device. Similar technologies include local storage, pixels and software development kits (SDKs) in mobile applications. We use "cookies" in this policy to mean all of these.
1.2 This policy is issued by [LEGAL ENTITY NAME] ("Fundly", "we", "us") and covers fundly.xyz and its subdomains. It should be read with our Privacy Policy at /legal/privacy.
2. Categories we use
2.1 Strictly necessary. Needed for the site to work and to keep it secure: session cookies, load balancing, the cookie consent record itself, fraud and bot protection. These cannot be switched off.
2.2 Functional. Remember choices you make, such as language, theme and whether you have dismissed a banner. Off by default.
2.3 Analytics. Help us understand which pages are used and where people get stuck, so we can improve the site. Data is aggregated where possible. Off by default.
2.4 Marketing. Measure whether our campaigns bring people to the site and limit how often you see an ad. We do not run third-party advertising on the site itself. Off by default.
3. The cookies
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| fundly_session | Fundly | Strictly necessary | Keeps you logged in on the web app | Session |
| fundly_consent | Fundly | Strictly necessary | Records your cookie choices | 12 months |
| fundly_csrf | Fundly | Strictly necessary | Protects forms against cross-site requests | Session |
| [BOT PROTECTION COOKIE] | [SECURITY PROVIDER] | Strictly necessary | Distinguishes people from bots | [DURATION] |
| fundly_lang | Fundly | Functional | Remembers your language | 12 months |
| fundly_theme | Fundly | Functional | Remembers light or dark mode | 12 months |
| fundly_ref | Fundly | Functional | Remembers a referral code from a link you clicked | 30 days |
| [ANALYTICS COOKIE] | [ANALYTICS PROVIDER] | Analytics | Counts visits and page views, anonymised IP | [DURATION] |
| [ANALYTICS SESSION COOKIE] | [ANALYTICS PROVIDER] | Analytics | Groups page views into a session | [DURATION] |
| [ATTRIBUTION COOKIE] | [ATTRIBUTION PROVIDER] | Marketing | Attributes sign-ups to a campaign | [DURATION] |
3.2 Providers marked as placeholders will be confirmed before launch. We will update this table when a cookie is added or removed.
4. Consent
4.1 When you first visit, we show a banner. Only strictly necessary cookies are set until you choose. "Accept all" turns on every category. "Reject all" keeps only strictly necessary cookies. "Manage" lets you choose per category.
4.2 We record your choice in the fundly_consent cookie and ask again after 12 months, or sooner if we add a new category.
4.3 Where the law does not require consent for analytics, we may rely on our legitimate interest in understanding how the site is used, with the same controls available to you.
5. How to manage cookies
5.1 Use the "Cookie settings" link in the footer of any page to change your choices at any time.
5.2 You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the site, including login, will not work.
5.3 To opt out of analytics from [ANALYTICS PROVIDER] you can also use their opt-out tool at [ANALYTICS OPT-OUT URL].
6. The web application and future mobile apps
6.1 Fundly launches as a web application, which uses the cookies in this policy. If we release mobile applications, they will not use browser cookies but will use device identifiers and SDKs for security (device fingerprinting, fraud checks), crash reporting and analytics. Security processing is necessary to protect your account and cannot be turned off. Analytics will be controllable in Settings. We will update this policy before any mobile application is released. See the Privacy Policy for the legal basis of each.
7. Third-party content
7.1 Some pages embed content from other services, such as a status page from [STATUS PROVIDER], support chat from [SUPPORT PROVIDER] or a video player. These services may set their own cookies when the embed loads. We load embeds only after you have accepted the relevant category, and we link to each provider's privacy notice next to the embed.
7.2 We do not use social media plugins that track you across sites. Share buttons on the blog are plain links.
8. Do Not Track and Global Privacy Control
8.1 If your browser sends a Global Privacy Control signal we treat it as a rejection of analytics and marketing cookies, and we will not show you the banner for those categories. We do not currently respond to the older Do Not Track header, because there is no agreed standard for it.
9. Changes
9.1 We may update this policy when we change the cookies we use or when the law changes. The date at the top shows the current version. Material changes will be flagged in the banner.
10. Contact
Questions about cookies: [DPO EMAIL]. Postal address: [LEGAL ENTITY NAME], [ADDRESS].