Cookie Policy

We use only one essential sign-in cookie (sf_session; HttpOnly, sent over encrypted connections, valid for 30 days) to keep you signed in.

The sign-up and password recovery pages use Cloudflare Turnstile for human verification, which may set essential security cookies to identify automated programs.

When you arrive through a friend's invite link, we set an mf_ref cookie (valid for 30 days) that only holds the invite code, so the invite reward can be granted after you sign up.

Interface preferences (such as language, whether the sidebar is collapsed, and whether you have seen the onboarding guide) are saved in your browser's local storage and are not uploaded to our servers.

Product analytics use PostHog: it sets first-party cookies (starting with ph_, valid for 1 year) and uses your browser's local storage to recognise the same visitor across visits, link your account once you log in, and record sessions. Browsers with Global Privacy Control (GPC) turned on do not load it.

To measure our advertising we use the Meta (Facebook) Pixel: it records page views on our public pages and notifies Meta when you create an account or complete a payment, so we can measure and optimise our ads on Facebook and Instagram. The Pixel sets first-party cookies (_fbp, valid for 90 days; plus _fbc when you arrive from a Meta ad) and may read Meta's own cookies. Our server sends the same sign-up and payment events to Meta as well (Conversions API); your email and account ID are only sent as SHA-256 hashes. The Pixel is not loaded on our mainland-China domain; browsers with Global Privacy Control (GPC) turned on do not load it, and our server does not send these events for them.

Right after you create an account we set the mf_signup cookie (valid for 10 minutes). It holds only the new account ID, so that the Pixel counts the sign-up once, and is then deleted.