This Cookie Policy explains how Ewing Technology Partners, LLC, doing business as
Tovari Financial ("we," "our," "us"), uses cookies and similar
technologies in Tovari — our personal finance product, which we present to you as
both "Tovari" and "Tovari Financial" — and on everything we provide around it: our website
(www.tovarifinancial.com, including our help documentation at www.tovarifinancial.com/docs), the
Tovari web application (app.tovarifinancial.com), and our mobile apps (together, the
"Services"). It should be read alongside our Privacy
Policy and Terms of Use, which define these same names the same way.
The short version
- Our marketing website uses HeyCatch analytics to see how people use it. HeyCatch sets a cookie and keeps a random visitor ID in your browser. It doesn't run in our apps or our help documentation, and it collects nothing from a browser that sends a "Do Not Track" signal.
- Apart from that, we don't set any cookies ourselves, and we don't use analytics, advertising, social media pixels, session recording, or any other tracking technology — not in our apps, not in our help documentation, and not in our emails.
- Our apps store a few things in your browser or on your device so they work — for example, to keep you signed in.
- A few providers we rely on — Stripe, Google, Apple and Plaid — load their own code in our web app, and that code may use cookies or receive information about your browser. They are described below.
What are cookies and similar technologies?
A cookie is a small text file that a website stores in your browser. "Local storage" and "session
storage" are similar technologies that let a web application save small amounts of data in your
browser; session storage is cleared when you close the tab. Mobile apps can store data in your
device's secure storage. All of these can be used to remember preferences, keep you signed in, and
help an app work.
What we store in your browser or on your device
Tovari web app (app.tovarifinancial.com)
- tovari-auth (local storage) — keeps you signed in. It holds a sign-in refresh token that lasts up to 30 days and basic profile details (your name, email address and household). Strictly necessary. Signing out clears it.
- tovari-device-view (local storage) — remembers whether you chose the desktop or mobile layout.
- tovari-table-layout (local storage) — remembers the column widths you set in tables.
- tovari-query-cache (session storage) — a temporary copy of your account list (including balances), your payees and reference data, so screens load faster. It is cleared when you sign out or close the tab.
Help documentation (www.tovarifinancial.com/docs)
- starlight-theme (local storage) — your light or dark theme choice.
- starlight-synced-tabs__platform (local storage) — which platform's instructions (such as web or iPhone) you chose last.
- sl-sidebar-state (session storage) — which sections of the sidebar are open.
Our website (www.tovarifinancial.com)
- Names beginning ph_ (a cookie, local storage and session storage) — set by HeyCatch, our website analytics provider, on our marketing pages. They hold a random visitor ID and details of your current visit, so we can count visits and see which pages and buttons are used. The cookie lasts up to a year; the session storage is cleared when you close the tab.
- heycatch_session_volume (local storage) — also set by HeyCatch: a count of the analytics events sent during your current visit, so a fault on our pages can't flood the analytics.
- Nothing above is stored, and nothing is collected, when your browser sends a "Do Not Track" signal.
Mobile apps
- Your sign-in session, kept in your device's secure storage (the iOS Keychain, or the Android Keystore). On iPhone you can require Face ID to unlock it; Face ID is handled entirely by your device, and we never receive your biometric information.
- Your notification settings and a random installation ID, used only to deliver push notifications to your device.
Apart from our website analytics, none of this storage is used to track you or build a profile, and
we don't share its contents with third parties.
Third-party technologies in our web app and websites
- Stripe — our web payment processor. Stripe's code (Stripe.js) loads in our web app so you can enter payment details securely, and may set cookies such as __stripe_mid and __stripe_sid to help prevent fraud. See the Stripe Privacy Policy.
- Google — Sign in with Google loads Google's sign-in code in our web app, and our web app, website and help documentation use Google Fonts. When this code or these fonts load, Google receives your IP address and basic browser information, and Google's sign-in code may use Google's own cookies. See the Google Privacy Policy.
- Apple — where Sign in with Apple is offered on the web, our sign-in page loads Apple's sign-in code. See Apple's Privacy Policy.
- Plaid — when you link a bank, Plaid's secure window loads and may use cookies or similar technologies for security and fraud prevention. See the Plaid End User Privacy Policy.
- HeyCatch — analytics on our marketing pages only, not in our apps or help documentation. Its code records the pages you view, the links and buttons you click, how you arrived (such as the website or campaign link that sent you), and your IP address, browser and device type, against the random visitor ID described above. HeyCatch processes this for us as our service provider: it doesn't sell it or use it for advertising, and it relies on its own providers, including PostHog, to run its service in the United States. Its code is delivered by esm.sh, a public code-delivery network, which receives your IP address and basic browser information when the code loads. See the HeyCatch Privacy Policy.
Apart from HeyCatch, which we use to understand how our website is used, these providers'
technologies support the feature you are using. None of them is used for advertising on our behalf,
and we don't control the cookies Stripe, Google, Apple or Plaid set.
Emails
Our emails don't contain tracking pixels or tracked links. Our email provider tells us only whether
a message was delivered, bounced, or was marked as spam.
Do Not Track and cookie consent
We don't show a cookie-consent banner. Everything our apps store is needed for the Services to work
or remembers a choice you made, and our website analytics is limited to understanding how the
website is used: we don't sell what it collects or share it for advertising, and it doesn't follow
you to other websites.
Our website respects the "Do Not Track" setting in your browser: when your browser sends it, HeyCatch
stores nothing and collects nothing about your visit. Our apps don't respond to "Do Not Track"
signals, because they don't do the cross-site tracking those signals are meant to stop. Because we
don't sell personal information or share it for targeted advertising, there is nothing for a Global
Privacy Control signal to switch off.
Managing cookies and storage
You can control or delete cookies through your browser settings, and you can clear local and session
storage the same way. Clearing the web app's storage signs you out, and blocking it may prevent you
from signing in or cause parts of the Services to stop working properly. In our mobile apps, signing
out removes your sign-in session from the device. Blocking or clearing cookies and storage on our
website stops or resets its analytics visitor ID, and the website keeps working normally.
Changes
If we add advertising or other non-essential technologies, or use analytics anywhere other than our
marketing website, we will update this policy first and, where required, ask for your consent.
Questions? Email
privacy@tovarifinancial.com.