Legal
Cookie Policy
Last updated: October 9, 2026
This policy applies to both the marketing website (faktor400.com) and the Faktor400 application (app.faktor400.com). Where the technologies used differ, this is indicated.
1. What Are Cookies and Similar Technologies?
Cookies are small text files stored by your browser on your device when you visit a website. They serve to make the website functional and to facilitate its use.
In addition to cookies, we also use Web Storage (Local Storage and Session Storage). These technologies are also subject to § 25 TDDDG and are covered in this policy.
2. Which Cookies and Storage Technologies Do We Use?
2.1 Strictly Necessary Cookies
These cookies are absolutely necessary for the operation of the website and the Faktor400 platform. They are set without consent.
| Cookie / Storage | Type | Scope | Purpose | Retention |
|---|---|---|---|---|
| __Host-f400_session | Cookie (HttpOnly) | App | Sign-in session; Supabase's authentication tokens stay on our server | Until sign-out; at most 30 days without use |
| __Host-f400_refresh_token | Cookie (HttpOnly) | App (public demo) | Renews the anonymous demo session | Until the demo session expires |
| __Host-f400_oauth_google_nonce | Cookie (HttpOnly) | App | Protects the Google sign-in flow | 10 minutes |
| __Host-f400_reset | Cookie (HttpOnly) | App | Password reset | 15 minutes |
| faktor400-language | Cookie | Both | Store selected language (DE/EN) | 1 year |
| faktor400-timezone | Cookie | App | User timezone for date display | Session |
| faktor400-org-timezone | Cookie | App | Organization timezone for financial buckets | Session |
| faktor400-theme-id | Local Storage | App | Selected color scheme / theme | Until manual deletion |
| faktor400-layout | Local Storage | App | Layout preference (e.g., sidebar state) | Until manual deletion |
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in website operation) in conjunction with § 25(2) TDDDG.
2.2 Local Storage / Session Storage (App)
| Key | Purpose | Retention |
|---|---|---|
| auth_token (Local Storage) | Public demo only: access token (JWT) of the anonymous demo session for API requests | Until the demo session expires / manual deletion |
| auth_user (Local Storage) | Cached profile data of the signed-in user (no access token) | Until sign-out / manual deletion |
| faktor400-cookie-consent (Local Storage) | Stores the user's cookie consent choice (granted / denied) | Permanent (until manual deletion) |
Additional UI state data (e.g., filter settings) may be added in future development and will be documented here.
Legal basis: § 25(2) TDDDG (technically necessary, no consent required).
2.3 Analytics Cookies
Within the Faktor400 app, we use PostHog as an analytics tool. PostHog cookies and storage are only set after explicit consent (via cookie banner).
| Cookie / Storage | Type | Scope | Purpose | Retention |
|---|---|---|---|---|
| ph_*_posthog | Cookie | App | PostHog session identification | 1 year |
| ph_* | Local Storage | App | PostHog event buffer and user assignment | Until manual deletion |
PostHog stores analytics data in its EU region (eu.posthog.com). Autocapture is disabled; only explicitly defined events are captured. Session recording is disabled. The Do-Not-Track browser setting is respected.
Provider: PostHog, Inc., San Francisco, CA, USA (storage in the EU region; transfers to the USA possible, based on the EU Standard Contractual Clauses).
On the landing page (faktor400.com), no analytics cookies are currently used.
Legal basis: Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TDDDG.
2.4 Marketing Cookies
We do not use marketing or retargeting cookies. Should this change, these cookies will be documented here and only activated after consent.
3. Third-Party Cookies
| Provider | Scope | Cookie Type | Purpose | Consent |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore — EU region Frankfurt) | App | Strictly necessary | Authentication (session cookie via our server) | No (§ 25(2) TDDDG) |
| Stripe (Stripe Payments Europe, Limited) | App (Checkout) | Strictly necessary | Payment processing, fraud prevention | No (§ 25(2) TDDDG) |
| PostHog (PostHog, Inc., USA — storage in the EU region) | App | Analytics | Product analytics, event tracking | Yes (consent) |
Third-country transfer: Supabase Pte. Ltd. is based in Singapore; authentication data is hosted in the EU region Frankfurt. Where the provider accesses it from a third country (e.g. support, operations), this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). PostHog, Inc. is based in the USA; analytics data is stored in PostHog's EU region, and processing in the USA is possible — based on the EU Standard Contractual Clauses. Stripe Payments Europe, Ltd. is based in Ireland (EU) — no third-country transfer. Details: Privacy Policy § 8.
4. Consent Management (Cookie Banner)
Since the Faktor400 app uses PostHog as an analytics tool, a cookie banner with an opt-in function for analytics cookies is required. Analytics cookies are only set after explicit consent. Strictly necessary cookies continue to be set without consent. You can change your preferences at any time via the 'Cookie Settings' link in the app footer or your browser settings.
5. Managing Cookies in Your Browser
You can manage and delete cookies in your browser settings:
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Settings → Privacy & Security → Cookies
- Safari: Settings → Privacy → Cookies
- Edge: Settings → Cookies and Site Permissions
Please note: Disabling strictly necessary cookies may prevent the website from functioning properly.
6. Changes
We update this cookie policy as needed, in particular when we introduce new cookies or technologies. Registered users will be notified of material changes by email.
Contact
Questions about cookie usage: datenschutz@faktor400.com
Language Versions
In the event of discrepancies between the German and any English version of this cookie policy, the German version shall prevail.