Heart.Fi

Cookie Policy

Last updated: August 29, 2026Effective: August 29, 2026

CRYPTO HEARTS LLC COOKIE POLICY

Last Updated: August 29, 2026

Effective Date: August 29, 2026

This Cookie Policy explains how Crypto Hearts LLC ("Crypto Hearts," "we," "us," or "our"), doing business as Heart.Fi, uses cookies and similar tracking technologies on the Heart.Fi platform at heart.fi and in our mobile applications (the "Platform").

For how we handle personal information generally — including the identity and financial data we collect for verification — see our Privacy Policy.

Cookies are small text files stored on your device when you visit a website. They help websites remember information about your visit, making subsequent visits easier and the site more useful. Similar technologies include localStorage, sessionStorage, and web beacons.

We categorize cookies into two types based on whether consent is required:

Strictly Necessary Cookies (No Consent Required)

These cookies are essential for the Platform to function. They cannot be disabled without breaking core functionality.

Authentication Cookies (Better Auth):

Cookie/StoragePurposeDurationProvider
Session TokenStores authentication token to maintain your logged-in sessionSession / PersistentBetter Auth (First-Party)

Security Cookies (Cloudflare):

Cookie NamePurposeDurationProvider
__cf_bmBot management - identifies and mitigates automated traffic to protect against attacks30 minutesCloudflare
__cflbLoad balancer session affinity - ensures you connect to the same server for consistent experienceUp to 24 hoursCloudflare
_cfuvidRate limiting - distinguishes individual users sharing the same IP addressSessionCloudflare
cf_clearanceChallenge platform - stores proof that you passed a security challenge (CAPTCHA)ConfigurableCloudflare
__cfruidRate limiting identificationSessionCloudflare

Identity Verification (during verification only):

Cookie/StoragePurposeDurationProvider
Verification session storageMaintains state through the identity verification flow and prevents session replayDuration of the verification sessionDidit (identity verification provider)

These are set only while you are completing identity verification, are strictly necessary for that flow to work, and are governed additionally by the provider's own privacy policy.

Analytics Preference Storage:

Storage KeyPurposeDurationProvider
analytics_disabled (localStorage)Stores your analytics opt-out preference on current browserPersistentCrypto Hearts (First-Party)
Analytics Cookies (Consent Required)

These cookies help us understand how you use our Platform so we can improve it. They are only activated after you provide consent.

PostHog Analytics:

Cookie NamePurposeDurationProvider
ph_<project_key>_posthogProduct analytics - stores distinct ID, session ID, device ID, and feature flag states365 daysPostHog (First-Party)

What PostHog Collects (When Enabled):

  • Page views and navigation patterns
  • Feature interactions and button clicks
  • Session duration and frequency
  • Device type and browser information
  • Anonymized user identifiers

PostHog data is processed in the EU (Frankfurt) and is subject to our Data Processing Agreement. PostHog is SOC 2 Type II certified.

Browser Controls: Most browsers allow you to:

  • View cookies stored on your device
  • Delete all or specific cookies
  • Block all or third-party cookies
  • Set preferences for specific websites

Browser-Specific Instructions:

  • Chrome: Settings > Privacy and Security > Cookies
  • Firefox: Settings > Privacy & Security > Cookies and Site Data
  • Safari: Preferences > Privacy > Manage Website Data
  • Edge: Settings > Cookies and Site Permissions

Important: Blocking strictly necessary cookies may prevent the Platform from functioning correctly, including login and security features.

Our strictly necessary cookies are set by third-party services (Cloudflare) but operate as first-party cookies on our domain. These services process data according to their privacy policies:

Our custody partner may set its own storage on the pages it serves during verification and fiat setup. Those pages are governed by that partner's own cookie and privacy policies, which are presented to you at the time.

Some browsers transmit "Do Not Track" (DNT) signals. We do our best to honor DNT signals by configuring our analytics to respect this browser setting. Additionally, we provide granular control through our cookie consent preferences and the analytics opt-out toggle in Settings > Privacy & Data.

We may update this Cookie Policy periodically. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be highlighted in our cookie consent interface.

For questions about our use of cookies:

Email: info@heart.fi