Legal / Version 2026-10-25-draft
Cookie Notice
Draft for counsel review (2026-10-25). Describes essential sign-in storage and optional, consented invitation attribution. No third-party advertising or analytics cookies are used.
Ombudly uses essential cookies and storage to sign you in and protect your account. A separate, optional first-party cookie remembers an invitation only after you choose Accept invitation on its page. We do not use third-party advertising pixels, third-party attribution cookies or analytics cookies.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
Session cookie (__session and Clerk's __client cookies) | Ombudly / Clerk | Keeps you signed in and protects against forged requests | Your session, up to [7] days |
__Host-ombudly_mfa | Ombudly | Confirms a verified second factor for your specific sign-in session; opaque, Secure, HttpOnly cookie | Up to 12 hours; revoked earlier when applicable |
__Host-ombudly_invite (optional) | Ombudly | Remembers the invitation you explicitly accepted; opaque, Secure, HttpOnly, SameSite=Lax cookie | 30 days, or earlier when claimed, declined or forgotten |
ombudly-session and bank-link state (session storage) | Ombudly | Carries your sign-in through an email or bank connection and resumes it if the page reloads | Until you close the tab |
ombudly:app-intent (session storage) | Ombudly | Stores only the fixed value programs to open Invite & earn after sign-in and second-factor verification; contains no identity, invitation or redirect URL | Until the app consumes it or you close the tab |
| Bank-connection storage | Plaid (inside the Plaid Link window) | Runs the bank connection you start | While Link is open |
You can decline invitation attribution and still use Ombudly. Before an invitation is claimed, its page lets you forget the saved invitation; clearing the cookie in your browser also removes it there. The first active accepted invitation is retained across other links. A claimed invitation becomes an account record and is no longer controlled only by the browser cookie. It does not give a partner access to your financial data.
Blocking essential sign-in cookies prevents normal sign-in and second-factor verification. Blocking the optional invitation cookie affects attribution, not ordinary app access. No invitation cookie is set merely because you visit a link. Read the referral rules or affiliate rules before accepting an invitation.
Questions: [privacy@ombudly.com].