Cookie Policy
1. What cookies are
A cookie is a small text file placed on your device by your browser when you visit a website. Cookies are used by most websites to remember you between requests, keep you signed in, and store preferences. Cookies can be first-party (set by the site you are on) or third-party (set by another site whose content is embedded).
2. The complete list of cookies we set
All cookies TraderReflect uses are first-party, marked HttpOnly (invisible to JavaScript), Secure (only sent over HTTPS), and scoped with a strict SameSite attribute to prevent cross-site misuse. All of them are strictly necessary within the meaning of ePrivacy Art. 5(3) and Swiss FADP guidance — the Service cannot function without them — so no consent banner is required to set them.
| Name | Purpose | Lifetime | Attributes |
|---|---|---|---|
next-auth.session-token(or __Secure-next-auth.session-token in production) | Keeps you signed in between page loads. Contains a signed JWT session token; no personal data is stored in the cookie itself. | 7 days | HttpOnly, Secure (prod), SameSite=Lax, Path=/ |
__Host-admin-session | Admin step-up session for privileged administrative actions. Never issued to a non-admin account. | 30 minutes | HttpOnly, Secure, SameSite=Strict, Path=/ |
__Host-mfa-challenge | Temporary challenge cookie set while you complete a multi-factor authentication step during sign-in. Deleted immediately once MFA verification succeeds or fails. | 5 minutes | HttpOnly, Secure, SameSite=Strict, Path=/ |
__Host-webauthn-reg-challenge | One-time nonce required by the WebAuthn/passkey standard while you enrol a new security key. | 5 minutes | HttpOnly, Secure, SameSite=Strict, Path=/ |
__Host-webauthn-auth-challenge__Host-webauthn-stepup-challenge | One-time nonces required by WebAuthn while you authenticate with an existing security key (login or admin step-up). | 5 minutes | HttpOnly, Secure, SameSite=Strict, Path=/ |
__Host-totp-setup-pending | Binds a TOTP enrolment attempt to the browser that started it, so an attacker-in-the-middle cannot hijack an in-progress enrolment. | 10 minutes | HttpOnly, Secure, SameSite=Strict, Path=/ |
tr_impersonate | Signed token that indicates an authorised admin is temporarily viewing the Service as another user for support / debugging purposes. Only issued after admin MFA step-up. Present only on admin sessions during an active impersonation. See the Privacy Policy for the full description of admin impersonation. | 30 minutes | HttpOnly, Secure (prod), SameSite=Lax, Path=/ |
2b. Browser storage (localStorage / sessionStorage)
In addition to the cookies above, the Service uses your browser’s localStorage and sessionStorage to remember your own UI preferences and cached read models. These are treated equivalently to strictly-necessary cookies under ePrivacy Art. 5(3) and Swiss FADP guidance because they are set by the first-party Service, are needed for the UI to remember your choices, and are never sent to any server. They persist until you clear your browser data.
| Key pattern | Purpose | Lifetime |
|---|---|---|
tr_be:<email>, tr_be:last | Remembers your breakeven threshold so it applies immediately on next visit before the server-side value loads | Persistent (until cleared) |
tr_points:<email>, tr_accounts:<email> | Cached last-known Reflect Points balance and account filter so the dashboard renders instantly before fetch completes | Persistent |
dj:* (e.g., dj:today-expanded, dj:section:executed-trades:expanded) | Daily-journal section expand/collapse state so the page opens the way you left it | Persistent |
journal:pre-market-open, journal:eod-open, and other per-section open/closed flags | Same as above for other pages | Persistent |
tr:pnl-card:handle | Remembers the display handle you enter on the P&L card share screen | Persistent |
tr:copy-cluster-snooze | Remembers copy-trade cluster suggestions you dismissed so we don’t re-surface them | Persistent |
hc-feedback:<slug> (sessionStorage) | Prevents you from submitting the same help-article feedback twice per browser tab | Cleared when you close the tab |
No entry above contains data beyond your own email, preferences, or your own account state. Clearing them will not sign you out, but the app will render with defaults until server-side data reloads.
3. Analytics, advertising, and social cookies
We do not set any analytics, advertising, or social-plugin cookies. We use Vercel Analytics and Speed Insights for aggregate page-view counts and Core Web Vitals; both are cookieless by design and collect only anonymised metrics.
4. Third-party embeds
Google Fonts: the Service uses four typefaces (Inter, Outfit, JetBrains Mono, DM Mono) loaded from Google’s content-delivery network at fonts.googleapis.com and fonts.gstatic.com. Loading a font from Google causes your browser to send Google your IP address and User-Agent so it can serve the font file. Google does not set any cookie during this exchange (the request is cookieless), the font-file cache lasts a full year (so most page loads after the first do not hit Google at all), and no TraderReflect account identifier is included in the request. Google’s handling of this metadata is governed by the Google Fonts Privacy FAQ. If Google being a recipient of your IP address for font loading is not acceptable to you, you can block fonts.gstatic.com at the browser or network level; the Service will fall back to your system’s default sans-serif and mono fonts.
Broker OAuth / Stripe checkout / Stripe Identity: when you connect a broker, complete a Stripe checkout session, or start a Stripe Identity verification, you may briefly leave TraderReflect and land on that provider’s domain. Cookies set there are governed by that provider’s own cookie policy.
Sharing on X (Twitter): clicking “Share on X” on the P&L card page opens twitter.com’s intent page in a new tab. Twitter’s cookies apply from that point on.
5. How to control cookies
Because every cookie we set is strictly necessary, blocking them will prevent you from signing in or completing multi-factor authentication.
You can still manage cookies in your browser at any time:
6. Changes to this Cookie Policy
If we add a new cookie or a new integration that sets cookies on your device, this page will be updated and the “Effective” date at the top of this page will change. Material changes will be surfaced via email or an in-app banner.
7. Contact
Questions about cookies or any privacy topic: privacy@traderreflect.com.