Cookie Policy — EverCFO

EverCFO is operated by Celeste Business Advisors LLP (“EverCFO”, “we”, “our”, or “us”). This Cookie Policy explains what cookies and similar technologies EverCFO uses, why we use them, and the choices available to you. It supplements our Privacy Policy — for the rights you have over the underlying data, see Privacy Policy section 7.

1. What are cookies and similar technologies

A cookie is a small text file that a website places in your browser the first time you visit. On return visits, the browser sends the cookie back so the site can recognize you, keep you signed in, or remember your preferences. “Similar technologies” covers other client-side storage mechanisms that serve the same purpose, including browser localStorage, sessionStorage, and IndexedDB. This policy uses the word “cookies” to refer to all of them.

2. Categories of cookies we use

2.1 Strictly necessary

These cookies are required for the EverCFO application to function. Without them you cannot sign in and your session cannot be maintained. They are set when you authenticate and are removed when you sign out or your session expires.

Authentication. Session and refresh tokens that prove you are signed in. Managed by our authentication provider (Supabase). These session cookies use the SameSite=Lax attribute, so browsers do not send them with most requests started by other sites, and EverCFO is served only over HTTPS.
Page context. Lightweight values used to preserve your current workspace selection, sidebar state, and theme preference between page navigations.

You cannot disable strictly necessary cookies inside EverCFO. Disabling them at the browser level will prevent sign-in.

2.2 Analytics and product

These cookies measure how the EverCFO product is used so we can improve it. They are first-party cookies set by EverCFO and read by our analytics sub-processor.

PostHog. Page-event metadata, error events for replay, and feature-flag exposure. Used to debug regressions, prioritize improvements, and measure feature adoption. These events may be linked to your email address (for example after you sign up with email and password). They are sent through EverCFO’s own /ingest address to PostHog in the United States. PostHog is listed in our sub-processor register; see PostHog’s own privacy practices at posthog.com/privacy.

2.3 Third-party cookies set by connected integrations

When you connect a third-party service to EverCFO, the connecting flow itself may set cookies under that third party’s control while you complete the connection.

Shopify install flow. Shopify sets connection-state cookies when you authorize EverCFO from inside your Shopify Admin.
Plaid Link. When the bank-integration feature ships (see Privacy Policy section 10), Plaid Link will set its own consent-flow cookies inside the Plaid-served frame during a connection attempt.
OAuth callbacks (QuickBooks Online, Xero, Nango). The OAuth handshake that authorizes EverCFO to read your accounting data may set state cookies used to complete the redirect back to EverCFO.

These cookies are set and controlled by those providers. EverCFO does not read them.

3. Your choices

You have two real, working ways to manage analytics cookies in EverCFO today. We do not list options that are not yet built; when an in-product opt-out toggle becomes available, we will update this section and announce the change.

Browser controls. Every major browser lets you block cookies and site storage for a specific site or clear them. Blocking cookies and site storage for evercfo.ai limits PostHog tracking on EverCFO. Note that blocking strictly necessary cookies will prevent sign-in. We do not currently act on Do-Not-Track signals.
Email request. Email our privacy contact at privacy@evercfo.ai from the address associated with your EverCFO account and ask us to opt your account out of product analytics. This is a manual process: our team applies the opt-out to your account in PostHog and confirms in writing without undue delay.

We do not honor browser-level strictly necessary cookie blocking as a privacy choice because doing so would prevent the EverCFO application from functioning. Users who do not wish to use authentication cookies should not sign in.

4. Changes to this Cookie Policy

We may update this Cookie Policy from time to time. Material changes will be announced inside the EverCFO product and via email to the account owner at least 30 days before they take effect. The “Last updated” date and version at the top of this page always reflect the current version.

5. Contact

Questions about this Cookie Policy or about a specific cookie EverCFO sets can be sent to our privacy contact at privacy@evercfo.ai. For the broader privacy program and full contact details, see Privacy Policy section 13.