Cookie Policy

The GoFindStuff application sets the strictly-necessary cookies listed below to keep you signed in and to protect against cross-site request forgery. With your permission it also uses Meta (Facebook) advertising cookies to measure which of our ads bring people to GoFindStuff. Advertising cookies are off until you choose “Accept all” (or switch them on under “Details”) in our cookie prompt.

A cookie is a small text file that a website stores on your device. Similar technologies (localStorage, sessionStorage, and first-party fingerprinting signals) work in comparable ways. This policy uses the word “cookies” to refer to all of these.

Strictly necessary — set automatically when you sign in:

• gofindstuff_token — short-lived (15 minute) JWT access token. HttpOnly, Secure (in production), SameSite=Lax, first-party. Cleared on sign-out.
• gofindstuff_refresh — refresh token used to mint new access tokens for up to 7 days. HttpOnly, Secure (in production), SameSite=Lax, first-party. Cleared on sign-out.
• gofindstuff_guest — anonymous identifier used for a guest session before sign-up, so a visitor can try the scan flow without an account. HttpOnly, Secure (in production), SameSite=Lax. Replaced by the auth cookies on sign-up.

We also store a single first-party value in browser localStorage (gofindstuff-cookie-consent) to remember that you have seen and answered the cookie prompt. You can reset it from Settings → Privacy.

Strictly necessary cookies do not require consent under GDPR or the ePrivacy Directive, and we cannot disable them without breaking authentication.

If you accept advertising cookies, we load the Meta Pixel from connect.facebook.net. It sets:

• _fbp — Meta browser identifier, first-party, up to 90 days.
• _fbc — records the Facebook / Instagram ad click that brought you here, first-party, up to 90 days.

Meta may also read its own cookies on facebook.com. We use this only to count page views, sign-ups and subscriptions that came from our ads; see the Meta section of our Privacy Policy. We also keep a first-party record in localStorage (gfs-attribution) of the campaign link you arrived from (UTM parameters), which is stored with your account at sign-up and never sent to Meta.

• We do not run third-party analytics (no Google Analytics, Plausible, PostHog, Mixpanel, Amplitude, etc.).
• We do not use session-replay or heatmap tools.
• We do not embed other social-media trackers.

You can clear cookies in your browser's settings at any time. Clearing the application's session cookies will sign you out. You can change your advertising-cookie choice any time with the Cookie settings link in the site footer.

Most browsers offer a “Do Not Track” signal and a Global Privacy Control (GPC) header. We honour these as opt-out signals to the extent required by applicable law.

We may update this policy when we add or remove cookies. Material changes will be reflected in the policy version at the top of the page.

Questions: privacy@gofindstuff.com.