Legal documents
Cookie Policy
Which cookies Finora uses, why they are needed and how to manage your consent.
Last revised: 08 October 2026
This policy explains how „П енд П“ ЕООД uses cookies and similar technologies in the Finora web application. It is drawn up under Art. 4b of the Bulgarian Electronic Communications Act (transposing Directive 2002/58/EC) and Regulation (EU) 2016/679 (GDPR).
This English version is provided for convenience. In case of discrepancy, the Bulgarian version prevails.
1. What cookies are
Cookies are small text files stored on your device when you visit a website. Similar technologies include local storage and session storage — they also keep information in your browser and are therefore covered by this policy and by the consent tool.
Cookies may be first-party (set by Finora) or third-party (set by another provider). By duration they are session cookies (deleted when the browser closes) or persistent cookies (kept for a defined period).
2. On what basis we use them
- Strictly necessary — no consent is required under Art. 4b(3) of the Electronic Communications Act, because without them the service you explicitly requested cannot be provided (for example staying signed in).
- All other categories — set only after your explicit consent under Art. 6(1)(a) GDPR. Consent is freely given, specific, informed and unambiguous, and can be withdrawn at any time as easily as it was given.
3. Strictly necessary (always active)
Without these, signing in and protection against abuse are impossible. They cannot be switched off in the consent tool, but you can block them in your browser settings — the application will then not work correctly.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| finora_access | Cookie (httpOnly) | Keeps you signed in between requests. Without it the application cannot recognise you. | Up to 15 minutes |
| finora_refresh | Cookie (httpOnly) | Renews your session so you do not have to re-enter your password on every load. | Up to 30 days with “Remember me”, otherwise until the browser is closed |
| finora_cookie_consent | Cookie | Stores your cookie choices so we do not ask again. Contains only the categories, date and version of your consent. | 12 months |
| finora_google_state | Cookie (httpOnly) | CSRF protection for Google sign-in — ties the return from Google to the request you started. Set only if you click “Continue with Google”. | Up to 10 minutes |
| finora_google_verifier | Cookie (httpOnly) | The PKCE secret used to exchange Google's code for a token. Set only if you click “Continue with Google”. | Up to 10 minutes |
| finora_google_2fa | Cookie (httpOnly) | Carries the second login step (authenticator code) when an account with 2FA enabled signs in through Google. | Up to 5 minutes |
| finora_google_handoff | Cookie (httpOnly) and local storage | When you sign in with Google from the installed app, links the in-app browser to the app so it can sign you in there. Removed after confirmation. | Up to 3 minutes (cookie) / up to 6 minutes (local storage) |
| finora-offline | Local database (IndexedDB) | Stores your most recently loaded data (accounts, transactions, add-on records and your profile) so the application works without a connection — for viewing only. It is deleted when you sign out, when your session expires, and via “Clear offline data” in Settings → Preferences. | Until you sign out or clear it in the browser |
| Push notification subscription | Browser record (Push API) | Created ONLY if you turn notifications on yourself. It holds your device address with the browser’s push service (Google, Apple or Mozilla) and two keys used to encrypt the notification. The push service cannot read the notification content. It is deleted when you turn notifications off or revoke the permission in your browser. | Until you turn notifications off |
Authentication cookies carry the httpOnly (inaccessible to JavaScript), SameSite=Lax and, in production, Secure attributes — protecting them against script-based theft and CSRF attacks.
4. Preferences (optional)
These remember how you have set up the interface. If you decline this category the application works perfectly well, but each visit starts with the default settings.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| finora:theme | Local storage | Remembers light or dark mode. | Until cleared in the browser |
| finora:currency | Local storage | Remembers whether you view amounts in euro or leva. | Until cleared in the browser |
| finora.tx.pageSize | Local storage | Remembers how many rows per page tables show. | Until cleared in the browser |
| finora:install-prompt-dismissed-at (also with a product suffix, e.g. :AUTO) | Local storage | Remembers that you dismissed the “install as app” prompt so it is not shown again. Each product (Финора, Финора Ауто) installs separately and has its own key. | Until cleared in the browser |
| finora:onboarding-categories-seen | Local storage | Remembers that you opened the categories screen from the “First steps” checklist, so the step does not stay unchecked. | Until cleared in the browser |
| finora:dashboard-layout (also with a product suffix, e.g. :AUTO, :HOME) | Local storage | Remembers which dashboard layout you chose — classic or modern. Each product (Finora, Finora Auto, Finora Home) has its own dashboard and its own key. | Until cleared in the browser |
| finora:sidebar-collapsed | Local storage | Remembers whether you collapsed the side menu to an icon rail. | Until cleared in the browser |
| finora:money-notifications-seen | Local storage | Remembers which notifications in the Finora bell you have already seen, so it does not light up again for the same ones. | Until cleared in the browser |
| finora:home-notifications-seen | Local storage | Remembers which notifications in the Finora Home bell you have already seen, so it does not light up again for the same ones. | Until cleared in the browser |
| finora:auto-notifications-seen | Local storage | Remembers which notifications in the Finora Auto bell you have already seen, so it does not light up again for the same ones. | Until cleared in the browser |
| finora:addon-announcements-seen | Local storage | Remembers which notifications about new access to Finora Auto or Finora Home you have already seen, so the bell does not light up again for the same ones. | Until cleared in the browser |
| finora:product-switch-hint-seen | Local storage | Remembers that you have already been shown where to switch products (Finora, Auto, Home), so the hint is not shown a second time. | Until cleared in the browser |
| last-product | Local storage | Remembers the last product you used (Finora, Finora Auto or Finora Home), so we can take you straight back there next time. | Until cleared in the browser |
| auto-selected-vehicle | Local storage | Remembers which vehicle you selected in the Finora Auto product bar (or “All vehicles”), so you do not have to choose again on every screen. | Until cleared in the browser |
| auto-link-transactions | Local storage | Remembers whether the “Also record as an expense in Finora” checkbox on a new fuel entry is turned on, so you do not have to turn it on again every time. | Until cleared in the browser |
| auto-stats-period | Local storage | Remembers the selected period (30 days, 3 months, since the start, etc.) on the “Statistics” screen in Finora Auto. | Until cleared in the browser |
| auto-stats-consumption-series / auto-stats-cost-series | Local storage | Remembers which lines/series you hid from the legend on the “Consumption over time” and “Monthly costs” charts in Finora Auto. | Until cleared in the browser |
| auto-tco-value:<vehicle ID> | Local storage | Remembers the manually entered current market value of a vehicle on the “Cost of ownership” screen in Finora Auto — one key per vehicle. | Until cleared in the browser |
| home-selected-property | Local storage | Remembers which property you selected in the Finora Home product bar, so you do not have to choose again on every screen. | Until cleared in the browser |
| home-link-transactions | Local storage | Remembers whether the “Also record as an expense in Finora” checkbox on a new property expense is turned on. | Until cleared in the browser |
| home-analysis-series | Local storage | Remembers which lines — income, expenses, profit — you hid from the chart legend on the Finora Home “Analysis” screen. | Until cleared in the browser |
| home-analysis-period | Local storage | Remembers the selected period (6, 12, 24 months, since the beginning) and chart mode on the Finora Home “Analysis” screen. | Until cleared in the browser |
| home-utilities-categories | Local storage | Remembers which categories (Electricity, Water, Heating, etc.) you chose to track on the Finora Home “Utilities” screen. | Until cleared in the browser |
| finora:offline-enabled | Local storage | Remembers whether you switched offline access off in Settings → Preferences. It is on by default; the key is written only on an explicit choice. | Until cleared in the browser |
5. Marketing and partner programme (optional)
Covers (a) partner referral attribution and (b) the Meta Pixel of Meta Platforms Ireland Ltd., which we use to measure how many visitors, sign-ups and payments come from our Facebook and Instagram ads. With your consent Meta receives the address of the public pages you view, a browser identifier (_fbp/_fbc) and, for sign-up and payment, a hashed email and amount through the Conversions API. Your financial data inside the application is never shared. The pixel does not load inside the application itself.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| finora_referral_ref | Session storage | Keeps the partner code from a referral link so the registration can be attributed to that partner. | Until the tab is closed |
| _fbp | Cookie (Meta) | Set by the Meta Pixel. Identifies the browser so we can measure how many visitors and sign-ups come from our Facebook and Instagram ads. | Up to 90 days |
| _fbc | Cookie (Meta) | Set when you arrive from a Facebook/Instagram ad (the fbclid parameter). Links the visit to the specific ad. | Up to 90 days |
| finora_ad_touch | Cookie (first party) | Remembers the UTM parameters and fbclid of the ad link so we can attribute your sign-up or payment to a campaign. | 30 days |
6. Statistics (optional)
We use Google Analytics 4 (a service of Google Ireland Limited) to understand how many visitors we have, which pages they view and through which channels they reach us. Google's script loads and the cookies below are set only after you consent to this category. IP anonymisation (anonymize_ip) is enabled.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| _ga | Third-party cookie (Google) | Anonymously distinguishes visitors so Google Analytics can count unique users. | 2 years |
| _ga_<property id> | Third-party cookie (Google) | Persists session state for Google Analytics 4. | 2 years |
Data is processed by Google and may be transferred to servers in the USA on the basis of Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework. We do not link this data to your Finora account. Details: policies.google.com/privacy. You can withdraw consent at any time via “Cookie settings”, after which we delete the _ga cookies and stop collection.
7. Third-party cookies
Third-party cookies may appear in the following cases:
- Stripe — during payment and on the card entry page. Stripe sets its own cookies for fraud prevention and for the payment form to work. They are necessary to complete the payment. Details: stripe.com/privacy.
- Google Analytics — only if you consented to the “Statistics” category (section 6). The
gtag.jsscript loads from a Google domain and sets the_gaand_ga_*cookies. - Meta (Facebook/Instagram) — only if you consented to the “Marketing” category (section 5). The
fbevents.jsscript loads from a Meta domain and sets the_fbpand_fbccookies.
8. How to manage your consent
- On this site: via the “Cookie settings” link in the footer of every page. You can change or withdraw your consent at any time, including refusing everything except the strictly necessary.
- In your browser: all modern browsers let you review, block and delete cookies in their settings. Deleting cookies will sign you out.
If you decline the optional categories we set nothing beyond the strictly necessary. Declining does not restrict your access to the Service or worsen the terms on which you use it.
We record when and to what you consented (date, time and policy version) so that we can demonstrate it under Art. 7(1) GDPR. We ask again after 12 months at the latest.
9. Changes to this policy
When new cookies are added or their purposes change we will update this page and request fresh consent where the law requires it. Questions: support@finora.bg.
You can save this document as a PDF using your browser's print function.