Cookie Policy

1. What Are Cookies and Storage Technologies?

Cookies are small text files stored on your device by websites you visit. Browser storage technologies (localStorage, sessionStorage, IndexedDB) are similar mechanisms that allow web applications to store data locally for functionality, performance, and user experience.

Lekkalu is a Progressive Web App (PWA) that works offline and stores all your financial data locally on your device. We use these technologies to:

• Authenticate you securely (remember your login session)
• Encrypt and store your financial data (transactions, accounts, investments)
• Cache application state (settings, preferences, UI state)
• Enable offline functionality (work without internet connection)
• Improve performance (reduce server requests, instant loading)

2. Storage Technologies We Use

Lekkalu uses four types of browser storage technologies. All are strictly necessary for core functionality:

3. localStorage (Persistent Data)

localStorage allows us to store data persistently across browser sessions. We use localStorage for:

3.1 Authentication State

• Purpose: Remember your login session so you don't have to re-authenticate every time
• Data stored: Session tokens, user ID (UUID), email verification status
• Encryption: Session tokens encrypted by Supabase (our auth provider)
• Duration: Until you log out or manually clear browser data
• Key prefix: sb-<project-ref>-auth-token

3.2 Zustand Stores (Application State)

We use Zustand (state management library) with localStorage persistence for 12 stores:

• investmentStore: Cached investment aggregates (portfolio value, unrealized gains)
• accountStore: Account metadata (names, types, colors - NOT balances)
• categoryStore: Category definitions and preferences
• creditCardStore: Credit card metadata (NOT card numbers or CVV)
• gamificationStore: Achievement progress and stats
• subscriptionStore: Subscription status cache (Pro vs Free tier)
• userSettingsStore: App preferences (currency, theme, privacy mode)

Note: Sensitive financial data (balances, transactions, investments) is NOT stored in localStorage. It is encrypted and stored in IndexedDB (see Section 5).

3.3 Other localStorage Keys

• onboarding-completed: Whether you've completed the initial onboarding flow
• theme-preference: Light/dark mode setting
• last-sync-timestamp: When data was last synced from server (for caching)

4. sessionStorage (Temporary Data)

sessionStorage stores data only for the duration of the browser session (until you close the tab). We use it for:

• Onboarding state: Current step in the onboarding wizard (Steps 1-5)
• Temporary form data: Multi-step forms to preserve data between steps
• Navigation state: Return URLs after authentication flows
• Error messages: Temporary alerts or notifications

Automatic deletion: All sessionStorage data is automatically deleted when you close the browser tab.

5. IndexedDB (Encrypted Database)

IndexedDB is a large-scale, structured database built into your browser. This is where all your financial data is stored, fully encrypted using AES-256-CBC encryption.

5.1 Zero-Knowledge Encryption

5.2 What's Stored in IndexedDB (21 Tables)

All data is stored in a database named LekkakuDB-v45-[userId] (version 45, per-user isolation):

Total storage: Typically 5-50 MB depending on usage (transactions, investments, etc.). All data remains on your device.

6. Cookies (Minimal Usage)

Lekkalu uses minimal cookies, primarily for authentication. All cookies are first-party (set by Lekkalu or Supabase on our behalf) and strictly necessary.

6.1 Authentication Cookies (Supabase)

• Cookie name: sb-<project-ref>-auth-token
• Purpose: Maintain your login session securely
• Type: HttpOnly, Secure, SameSite=Lax (prevents CSRF attacks)
• Duration: Session or persistent (configurable, default: 7 days)
• Domain: .lekkalu.app (first-party)
• Strictly necessary: Yes (cannot function without authentication)

6.2 No Tracking or Advertising Cookies

7. Third-Party Cookies & Storage

Third-party services we use may set their own cookies or storage. We use only privacy-respecting services:

7.1 Plausible Analytics (Landing Page Only)

• What it is: Privacy-friendly web analytics (self-hosted in Canada)
• Cookies: None (Plausible is 100% cookie-free)
• Data collected: Page views, referrers, country (NOT personal data, no IP addresses stored)
• Scope: Landing page only (lekkalu.app) - NOT the PWA app (app.lekkalu.app)
• Compliance: GDPR, PECR, CCPA, PIPEDA compliant - no consent required
• Privacy Policy: plausible.io/privacy
• Open source: Plausible is open-source and auditable (GitHub)

7.2 Supabase (Auth & Database)

• Cookies: Authentication tokens (first-party, HttpOnly)
• localStorage: Session refresh tokens
• Purpose: User authentication and session management
• Privacy policy: supabase.com/privacy

7.3 Cloudflare (Hosting & CDN)

• Cookies: __cflb (load balancing), __cf_bm (bot management)
• Purpose: Security (DDoS protection), performance (CDN caching)
• Duration: Session or 30 minutes
• Strictly necessary: Yes (essential for security and availability)
• Privacy policy: cloudflare.com/privacypolicy

7.4 No Third-Party Tracking

We do NOT use: Google Analytics, Facebook Pixel, advertising networks, or any third-party tracking tools within the PWA.

8. Why We Don't Need Consent (Strictly Necessary)

Under the ePrivacy Directive (Article 5(3)) and GDPR, cookies and storage technologies that are "strictly necessary" for core functionality do NOT require user consent.

8.1 Legal Definition of "Strictly Necessary"

Storage is considered strictly necessary if:

• It is essential for providing the requested service
• The service cannot function without it
• It is not used for secondary purposes (tracking, advertising)

8.2 Why Lekkalu's Storage Qualifies

8.3 Transparency Over Consent

While we don't legally require consent, we believe in transparency. This Cookie Policy explains exactly what we store, why, and how you can control it. You always have the right to:

• Clear your browser storage (removes all local data)
• Export your data (download encrypted backup)
• Delete your account (removes server-side data)

9. Your Control & Rights

You have full control over the data stored in your browser:

9.0 California Cookie Opt-Out Rights (CCPA/CPRA)

9.1 Clear Storage via Browser Settings

You can manually clear all storage at any time:

• Chrome: Settings → Privacy and security → Clear browsing data → Cookies and site data, Cached files
• Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
• Safari: Preferences → Privacy → Manage Website Data → Remove All
• Edge: Settings → Privacy, search, and services → Clear browsing data

Warning: Clearing storage will log you out and delete all local financial data. Make sure to export a backup first (Settings → Backup & Restore).

9.2 Clear Storage via Lekkalu App

• Logout: Settings → Logout (clears authentication tokens and Zustand stores)
• Delete account: Settings → Account → Delete Account (removes all data from IndexedDB and server)

9.3 Export Your Data (Portability)

• Encrypted backup: Settings → Backup & Restore → Export Encrypted Backup (ZIP file with all IndexedDB data)
• CSV exports: Transactions → Export CSV, Accounts → Export CSV (human-readable format)
• Decrypted JSON: Settings → Data Portability → Download All Data (requires password)

9.4 Block Cookies (Not Recommended)

You can block cookies in your browser settings, but Lekkalu will not function without authentication cookies. Blocking cookies will prevent login and access to your financial data.

10. Storage Duration & Retention

Note: Deleting your account removes all server-side data (email, user ID) within 30 days. Local data (IndexedDB) is deleted immediately but may remain in browser cache until you clear it manually.

11. Security Measures

We implement multiple layers of security to protect data stored in your browser:

11.1 Encryption (AES-256-CBC)

• All financial data encrypted before storage in IndexedDB
• Key derivation: PBKDF2 with 100,000 iterations (prevents brute-force attacks)
• Unique keys per user: Password + user ID (never shared across accounts)

11.2 HttpOnly Cookies (CSRF Protection)

• HttpOnly flag: Prevents JavaScript access to cookies (XSS protection)
• Secure flag: Cookies only sent over HTTPS (prevents interception)
• SameSite=Lax: Prevents cross-site request forgery (CSRF)

11.3 Per-User Database Isolation

• Separate IndexedDB per user: LekkakuDB-v45-[userId]
• No cross-user access: Cannot read other users' data even on shared device
• Automatic cleanup: Old databases deleted on logout

11.4 Input Sanitization (XSS Prevention)

• All user inputs sanitized before storage (DOMPurify)
• Script tags blocked: Prevents stored XSS attacks
• Content Security Policy: Restricts inline scripts and external resources

11.5 Browser Sandbox Protections

Browser storage technologies (localStorage, IndexedDB, cookies) are subject to browser security policies:

• Same-Origin Policy: Other websites CANNOT access Lekkalu's storage (enforced by browser)
• Secure contexts (HTTPS): Cookies and storage only accessible over encrypted connections
• Private browsing mode: Storage is automatically cleared when you close the browser
• Incognito mode: Storage is session-only and never persisted to disk
• Browser isolation: Each browser profile has separate storage (Chrome Profile 1 vs. Profile 2)

11.6 Third-Party Cookie Blocking

Modern browsers (Safari, Firefox, Brave) block third-party cookies by default. Lekkalu only uses first-party cookies (set by lekkalu.app domain), so we are NOT affected by third-party cookie blocking.

Upcoming changes (2025-2026): Google Chrome will phase out third-party cookies entirely. This does NOT affect Lekkalu as we don't use them.

12. Changes to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices, legal requirements, or new features. When we make changes:

• Notice: We will update the "Last Updated" date at the top of this page
• Material changes: We will notify you via email or in-app notification
• Review: We encourage you to review this policy periodically
• Continued use: Using Lekkalu after changes constitutes acceptance

Version history: Previous versions of this Cookie Policy are available upon request (see Contact Us below).

13. Contact Us

If you have questions about this Cookie Policy, browser storage, or your data rights, please contact us:

• Email: contact@lekkalu.app
• Website: lekkalu.app
• Contact Form: lekkalu.app/about