Cookies

What we set

Session cookie (__Secure-authjs.session-token) — keeps you signed in. We set it when you sign in (emailed magic link, passkey, or Google), when you save a calendar with a new email address and we open your account at once, and when you come back from checkout with a new account. It ends after 30 days without a visit, or when you sign out. The product cannot work without it.

Sign-in cookies — our sign-in library sets two cookies: a token that blocks forged sign-in requests, and the page to return to after sign-in. They end when you close the browser. During a sign-in with Google, one or two more cookies hold one-time check values. Each lasts at most 15 minutes.

Passkey cookie (cf.passkey.challenge) — holds a one-time challenge while you sign in with a passkey or add one. It lasts 5 minutes.

Acceptance cookie (cf.acceptance) — set when you tick the box to accept the Terms of Service and the Privacy Policy and then leave our page to sign in, or when you save a calendar for an address that must sign in first. It holds the versions you accepted, the time, your IP address and browser, a one-way code of your email address, the EIN you typed and the step where you ticked the box, so that the sign-in in this browser can record your acceptance. It lasts at most 1 hour, and we remove it once the acceptance is recorded.

What we don’t set

No advertising cookies. No third-party analytics cookies. No cross-site trackers. We do not embed Facebook, Google, or other ad-network pixels.

Stripe cookies on payment pages

Stripe takes our online payments. When you pay or manage a subscription on Stripe’s hosted pages, Stripe may set its own cookies there to make payment flows work and to detect fraud. See Stripe’s privacy and cookie policies for details.

Clearing cookies

Clearing CharityFile cookies signs you out. You can sign in again with emailed magic link, passkey, or Google.

For the broader picture of what data we collect and why, see the privacy policy.