Cookies

Operated by HARMONIUM LLC. Contact: hello@forgetyourcreditcard.com.

• Session / authentication cookie (Auth.js JWT, typically __Secure-authjs.session-token in production): keeps you signed in for about 7 days. HttpOnly, Secure in production.
• Auth.js CSRF / callback cookies: protect sign-in forms and post-login redirects. Necessary for the account.
• fycc_ref: set only if you open a referral link /r/…. Stores the code to attribute a referrer at signup (no payouts). 30 days, HttpOnly, SameSite=Lax, Secure in production.
• fycc_utm: set only if you arrive with a utm_source query parameter matching a short token (for example x). First-party attribution for 30 days, HttpOnly, SameSite=Lax. Not an advertising pixel and not shared with ad networks.

This application does not set third-party advertising cookies. Funnel pings are stored without emails, user ids, or Stripe ids. Stripe Checkout and the Customer Portal run on Stripe domains and may set their own cookies there.

Page views are counted first-party without cookies: only the page path and a traffic source category (for example x, google, or direct) are stored. No full referrer URL, IP address, or account id is stored with them. Browsers sending Global Privacy Control or Do Not Track are not counted.

See Privacy.