Cookie Policy
Last updated October 12, 2026
Kupaca Credit stores a small amount of information on your device. Most of it keeps the app working. One item helps us measure usage, and we set it only if you agree.
1.What this policy covers
This policy covers cookies and similar technologies: your browser's local storage and IndexedDB on the web, and the app's private storage on iOS and Android. We call all of these device storage.
We do not use advertising cookies. We do not track you across other websites or apps, and we do not sell or share what we store with advertisers.
2.Strictly necessary storage
These items are needed for Kupaca Credit to work, so we do not ask for consent to use them. Blocking them will stop you from signing in or will reset your settings.
- Sign-in session (Firebase Authentication, in IndexedDB): keeps you signed in until you sign out.
- Saved app data (kupaca-query-cache and kupaca:query-cache-owner): a copy of your recently loaded cards and benefits, so the app opens quickly and works offline. It is cleared when you sign out or another account signs in on the same device.
- Consent choice (kupaca.consent): remembers whether you accepted or declined analytics, so we do not ask on every visit.
- Appearance (theme): remembers whether you chose light, dark, or system appearance.
- Setup and sign-in markers (kupaca:onboarded and hasSignedIn): remember that you finished setup and have signed in on this device before, so we can skip the welcome page.
- App lock (biometricEnabled and biometricPrompted, mobile app only): remember whether you turned on Face ID, Touch ID, or fingerprint unlock on this device.
- Notification token (fcm_token, mobile app only): lets us stop reminders to this device when you sign out.
3.Strictly necessary storage set by our providers
A few services we rely on may set their own cookies or device storage, only when you use the feature they support:
- Web checkout (RevenueCat and Stripe): when you buy Pro on the web, the checkout loads Stripe, which sets cookies used to process the payment and prevent fraud.
- Bank connections (Pro only, once available): if you connect a financial account, the bank-connection provider's connection window may store information needed to complete the connection, under that provider's own privacy policy.
- Hosting and security: our hosting provider may set short-lived cookies that protect the service from abuse and automated traffic.
4.Analytics storage
Analytics identifier (kupaca.analytics.anonymousId): a random identifier that lets us count visits and app usage before you sign in, without knowing who you are. It is first-party: the events it labels go only to our own servers.
When you first visit, a banner asks whether you allow analytics. We set this identifier, and your device sends usage events, only after you accept. If your browser sends a Global Privacy Control or Do Not Track signal, we do not send usage events even if you accepted.
Our Privacy Policy, linked below, explains what usage events contain and how long we keep them.
5.Services that do not store anything on your device
- Crash reporting (Sentry): if the app hits an error, technical details about it are sent to Sentry. In our setup, Sentry does not set cookies or record your screen.
- Fonts: our fonts are served from our own servers, so loading a page does not contact a font provider.
6.Development builds and the test simulator
Internal development builds, and Kupaca staff testing the app from an admin account, can store kupaca.v2.simulator and kupaca.v2.simulatorUnlocked to show a simulated sample account instead of a real one. While the simulator runs, requests for account data are answered on the device with sample data and no analytics events are recorded. Customer accounts never set them.