Legal

Cookie Policy

Effective date: October 9, 2026

This Cookie Policy explains what cookies are, which ones Digital Family Home uses, why we use them, and how you can control them.

1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work correctly, improve user experience, and provide security. Cookies set with the HttpOnly flag cannot be read by JavaScript and are used specifically for secure server-side session management.

2. Our Approach

Digital Family Home uses three categories of cookies:

Essential (strictly necessary) cookies for authentication, session management, and security. These are always on.
Analytics cookies set by Google Analytics, loaded through Google Tag Manager, to understand how visitors find and use the Service so we can improve it. Off unless you accept them.
Marketing cookies set by the ad measurement tags of Meta, Google Ads (for our YouTube ads), LinkedIn and Reddit, which tell each of them when one of our ads led someone here so we can measure whether that advertising works. These include social media tracking pixels, and each company can use them to recognise you across other sites. Off unless you accept them, as a separate choice from analytics.

Nothing outside the essential category loads until you choose. If you accept analytics only, no marketing cookie or pixel is set at all. We do not sell the data collected through any of these cookies, and we set no personalisation cookies beyond what is described here.

You can change your mind at any time by clearing this site's cookies and site data in your browser, which brings the choice back on your next visit.

You retain full control over cookie storage through your browser settings, and you can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on.

3. Cookies We Use

The following cookies may be set when you use the Service:

Name	Type	Duration	Provider	Purpose
dfh_app_prompt	Essential	7 days	Digital Family Home	Remembers that you closed the "download the app" prompt on our home page, so it does not show again for 7 days. Holds no personal data.
dfh_link_scan	Measurement (first-party)	30 days	Digital Family Home	Browser storage, not a cookie. Set when you arrive through one of our own links or QR codes (for example from a flyer), so that if you sign up we know which one worked. Holds only the visit id, is sent only to us, once, and is deleted after signup or after 30 days.
refresh_token	Essential	30 days	Digital Family Home	Stores your encrypted session refresh token so you stay logged in across browser restarts. HttpOnly and Secure, inaccessible to JavaScript.
OAuth state cookies	Essential	Session (minutes)	Digital Family Home	Transient CSRF-protection state tokens generated during Google, Apple, or Microsoft sign-in flows. Deleted immediately after the OAuth callback completes.
_ga	Analytics	2 years	Google	Google Analytics cookie used to distinguish unique visitors and measure how the Service is used. Set via Google Tag Manager.
_ga_<container>	Analytics	2 years	Google	Google Analytics 4 cookie used to persist session state for usage measurement. Set via Google Tag Manager.
_gid	Analytics	24 hours	Google	Google Analytics cookie used to distinguish visitors over a short period for usage measurement.
_fbp	Marketing	90 days	Meta	Meta pixel cookie that lets Meta tell when one of our ads led to a visit or sign-up.
_gcl_au	Marketing	90 days	Google	Google Ads cookie that lets Google tell when one of our ads (including YouTube ads) led to a visit or sign-up.
li_fat_id, bcookie, lidc	Marketing	Up to 1 year	LinkedIn	LinkedIn Insight Tag cookies that let LinkedIn tell when one of our ads led to a visit or sign-up.
_rdt_uuid	Marketing	90 days	Reddit	Reddit Pixel cookie that lets Reddit tell when one of our ads led to a visit or sign-up.
__stripe_mid	Essential	1 year	Stripe	Stripe machine identifier used for fraud detection and secure payment processing.
__stripe_sid	Essential	30 minutes	Stripe	Stripe session identifier used for fraud detection and secure payment processing.

dfh_app_prompt

Remembers that you closed the "download the app" prompt on our home page, so it does not show again for 7 days. Holds no personal data.

dfh_link_scan

Browser storage, not a cookie. Set when you arrive through one of our own links or QR codes (for example from a flyer), so that if you sign up we know which one worked. Holds only the visit id, is sent only to us, once, and is deleted after signup or after 30 days.

refresh_token

Stores your encrypted session refresh token so you stay logged in across browser restarts. HttpOnly and Secure, inaccessible to JavaScript.

OAuth state cookies

Transient CSRF-protection state tokens generated during Google, Apple, or Microsoft sign-in flows. Deleted immediately after the OAuth callback completes.

_ga

Google Analytics cookie used to distinguish unique visitors and measure how the Service is used. Set via Google Tag Manager.

_ga_<container>

Google Analytics 4 cookie used to persist session state for usage measurement. Set via Google Tag Manager.

_gid

Google Analytics cookie used to distinguish visitors over a short period for usage measurement.

_fbp

Meta pixel cookie that lets Meta tell when one of our ads led to a visit or sign-up.

_gcl_au

Google Ads cookie that lets Google tell when one of our ads (including YouTube ads) led to a visit or sign-up.

li_fat_id, bcookie, lidc

LinkedIn Insight Tag cookies that let LinkedIn tell when one of our ads led to a visit or sign-up.

_rdt_uuid

Reddit Pixel cookie that lets Reddit tell when one of our ads led to a visit or sign-up.

__stripe_mid

Stripe machine identifier used for fraud detection and secure payment processing.

__stripe_sid

Stripe session identifier used for fraud detection and secure payment processing.

4. Authentication Cookie Detail

When you log in, we issue a refresh_token cookie with the following security attributes:

HttpOnly: cannot be read or modified by JavaScript, protecting against XSS attacks
Secure: transmitted only over HTTPS connections
SameSite=Strict: not sent on cross-site requests, mitigating CSRF
Max-Age: 30 days, expires automatically; refreshed on each active session

Your short-lived access token is stored in memory (not in a cookie or localStorage) and is never written to disk.

5. Stripe Payment Cookies

When you access the billing or payment section of the app, Stripe.js sets the __stripe_mid and __stripe_sid cookies on Stripe's behalf. These are used solely for fraud prevention and are governed by Stripe's Privacy Policy.

6. Google Analytics

We use Google Analytics, loaded through Google Tag Manager, to measure traffic and understand how the Service is used (for example, which pages are visited and how visitors navigate). Google Analytics sets the _ga, _ga_<container>, and _gid cookies. This data is used only to improve the Service and is governed by Google's Privacy Policy. You can opt out using the Google Analytics Opt-out Browser Add-on.

7. OAuth Sign-In Cookies

If you sign in using Google, Apple, or Microsoft, we temporarily set a short-lived state cookie during the OAuth handshake to prevent CSRF attacks. This cookie is deleted automatically once the sign-in flow completes (typically within seconds). No data from the OAuth provider is stored in cookies.

8. Managing & Deleting Cookies

You can control or delete cookies through your browser settings. Note that deleting or blocking the authentication cookie will log you out of the Service.

9. Changes to This Policy

We may update this Cookie Policy as our technology evolves. Any change will be reflected by an updated effective date at the top of this page. Material changes will be communicated via in-app notice.

10. Contact Us

If you have questions about our use of cookies, please contact us:
Digital Family Home
Submit an inquiry through our contact form.