Cookies

Cookies

All of Nummi’s cookies come from Auth.js, the login library the app is built on, and exist to keep you signed in and protect your account. None of them are readable by JavaScript (they’re all HttpOnly), none are shared with any other site, and Nummi sets no advertising, marketing, or third-party tracking cookies of any kind.

Names below are exactly what your browser shows (check your browser’s dev tools if you want to see for yourself) — the __Secure-/__Host- prefixes are a browser-enforced guarantee that the cookie can only ever have been set over a secure HTTPS connection, never intercepted or forged in transit.

• __Secure-authjs.session-token — proves you’re logged in. Without it, every page would ask for your password again. Lasts 7 days from your last visit, then you’re signed out automatically — shorter than most apps on purpose, since a shared or school device shouldn’t stay logged in for long.
• __Host-authjs.csrf-token — a security token that stops other websites from forging requests using your logged-in session (a standard web attack called cross-site request forgery). Purely defensive, never used to identify you.
• __Secure-authjs.callback-url — remembers which page to send you back to right after logging in, so following a link to a specific page and then logging in doesn’t dump you on the homepage instead.
• __Secure-authjs.pkce.code_verifier and __Secure-authjs.state — only created during the few seconds of an active “Sign in with Apple” attempt, and expire after 15 minutes either way. Standard OAuth security (PKCE) that proves the login response actually came from the same attempt you started, not something Apple provides Nummi to identify you by.

Other things saved on your device

• theme — whether you’re using light or dark mode, saved in your browser’s local storage (not a cookie, and never sent to our servers) so the app remembers your choice next time.
• nummi-cookie-notice-acknowledged — set when you dismiss the cookie notice banner, so it doesn’t show again. Also local storage, also never sent anywhere.
• nummi-static-v2 — offline support for the installed app: the app shell and icons, cached so the app still opens without a connection. Browser Cache Storage, not a cookie. Only ever holds static files Nummi ships — API responses and page data are deliberately excluded, so nothing personal or account-specific ever lands in it.

Analytics

Nummi uses Vercel Web Analytics and Speed Insights to see aggregate traffic and performance trends — things like which pages get visited and how fast they load. We checked, not assumed: both are genuinely cookieless. Vercel identifies visits with a one-way hash computed from the request itself, not a stored identifier, and that hash is discarded after 24 hours. Nothing is tied to your Nummi account, nothing persists across visits, and nothing is stored in your browser at all for this — see Vercel’s own privacy documentation for the technical detail.

Why there’s no “accept/decline” choice

Every cookie above is strictly necessary for Nummi to function or to keep your account secure — there’s no optional, non-essential, or advertising cookie to decline in the first place. Under the rules this kind of notice usually exists to satisfy (e.g. the EU/UK “cookie law”), strictly-necessary cookies are exempt from needing active consent — they just need to be disclosed clearly, which is what this page and the banner are for. If that ever changes (for example, if Nummi ever adds a non-essential cookie), this page and the banner will change to add a real decline option alongside it.

If Pro tier goes live

Nummi’s Pro tier isn’t active today (see the Privacy Policy). If it launches, checkout and billing happen on Stripe’s own hosted pages, which may set their own cookies under stripe.com’s domain — not Nummi’s, and not something this page controls. We’ll update this page with a link to Stripe’s own disclosures before that ever reaches a real user.