Cookie Policy
Last updated: 28 September 2026
Introduction
This Cookie Policy explains how Phinly Pty Ltd ("we", "us" and "our") uses cookies and similar technologies on our websites: www.phinly.com, auth.phinly.com, app.phinly.com and link.phinly.com. It explains what we set, why, and how to change your choice. Where cookies collect personal information, our Privacy Policy also applies.
You can change your cookie choice at any time using the Cookie settings link: in the footer of www.phinly.com, at the bottom of the sign-in pages at auth.phinly.com on larger screens, and under Settings, then Preferences, in the app.
If you have questions, email [email protected].
1. What are cookies?
Cookies are small text files a website stores on your device. We also use similar browser storage (localStorage and sessionStorage), and this policy treats them the same way. Cookies set by us are first-party cookies; cookies set by other companies are third-party cookies. Your cookie choice is stored for the whole phinly.com domain, so a choice you make on one of our sites applies to all of them.
2. The cookies we use
We use two categories: strictly necessary and analytics. We do not use advertising or tracking cookies, and we do not allow advertisers to set cookies on our sites.
Strictly necessary
These make the sites work: signing you in, keeping a sign-in or account connection secure while it is in progress, and remembering your settings and your cookie choice. They cannot be switched off.
| Cookie | Set on | Purpose | Expires |
|---|---|---|---|
| phinly_session | app.phinly.com | Keeps you signed in to the app. Contains your encrypted session. | 7 days |
| phinly_device_id | .phinly.com (set by the app) | Recognises this device so we can show you your signed-in devices and remember how you sign in. | 2 years |
| oauth_state | app.phinly.com | Protects the sign-in handoff between the app and auth.phinly.com. | 15 minutes |
| auth_context, authorization_code, google_oauth, apple_oauth | auth.phinly.com | Carry the state of a sign-in or social login while it is in progress. | 15 minutes |
| mfa_challenge | auth.phinly.com | Carries a two-step verification challenge while it is in progress. | 5 minutes |
| signup_poll | auth.phinly.com | Keeps track of a sign-up that is waiting for email confirmation. | 30 minutes |
| redirect_uri | auth.phinly.com | Remembers where to send you after you sign in. | 24 hours |
| link_request, provider_oauth | link.phinly.com | Carry the state of an account connection while it is in progress. | 15 minutes |
| phinly_cookie_consent | .phinly.com | Stores your cookie choice so we do not ask you again on our other sites. | 12 months |
| phinly_consent_policy | .phinly.com | Records which consent rules apply to your region (worked out from your IP country). Set by www.phinly.com, app.phinly.com and link.phinly.com. | 24 hours |
| theme, themePref | .phinly.com | Remember whether you chose light or dark mode. | 1 year |
Analytics
These help us understand how Phinly is used so we can improve it. They are not set if you reject analytics, or, in the regions described in section 3, until you accept.
| Cookie or storage | Set on | Purpose | Expires |
|---|---|---|---|
| ph_XXXX_posthog (X is our project key), plus PostHog entries in localStorage and sessionStorage | Each of our sites (PostHog) | Distinguishes visitors and sessions, records product analytics events and session replays, and stores your opt-in or opt-out status. | 1 year |
| _ga | www.phinly.com (Google Analytics) | Distinguishes visitors. | 2 years |
| _ga_XXXXXXXXXX (X is our tag ID) | www.phinly.com (Google Analytics) | Keeps session state. | 2 years |
Session replays reconstruct how you used a page, including what was shown on screen; text you type into form fields is masked. Section 6 of our Privacy Policy explains what is captured and where it goes.
3. How your choice works
- On www.phinly.com, auth.phinly.com and app.phinly.com you see a banner the first time you visit. "Accept all" turns analytics on, "Reject all" turns it off, and "Manage preferences" lets you choose. Your choice is stored in the phinly_cookie_consent cookie for 12 months, after which we ask again.
- If you are visiting from the European Union, the European Economic Area, the United Kingdom or Switzerland, nothing is stored on your device for analytics, Google Analytics does not load and no session replays are recorded until you accept. PostHog still collects basic usage events without storing anything on your device, and links them to your account if you are signed in. We work out your region from your IP address and store the result in phinly_consent_policy. If we cannot tell where you are, including when your first visit starts at auth.phinly.com, we treat you as if you were in one of those regions.
- Elsewhere, including Australia, analytics runs from your first visit until you reject it. When you reject, PostHog stops collecting and switches to memory only, and we delete any Google Analytics cookies that were set. A Google Analytics tag that has already loaded can keep sending visit data from that browser tab until the page is reloaded or closed.
- link.phinly.com does not show a banner. It honours the choice you made on our other sites and, if you have not made one, treats you according to your region as above.
- Once you are signed in to the app, analytics events are linked to your account. Rejecting analytics stops that too.
4. Managing cookies in your browser
You can also block or delete cookies in your browser settings (usually under Privacy or Security). If you block strictly necessary cookies, you will not be able to sign in or connect accounts. For Google Analytics, you can also install the Google Analytics opt-out browser add-on.
5. Changes to this policy
We update this policy when the cookies we use change. The date at the top shows the current version.
Contact us
If you have any questions about our Cookie Policy, please contact us at [email protected].