Skip to content
Sign in

Legal

Cookies

Last updated: 28 October 2026 · version 2026-10-28

HomesWallet uses only cookies necessary for sign-in and security and the browser's local storage for the encrypted data and settings. No advertising and no third-party analytics.

We use no advertising, tracking or analytics cookies and allow no such third-party cookies. We use only cookies without which sign-in and security cannot work, so we do not ask for consent to them and show no cookie banner. You can delete them in your browser's settings; you will then have to sign in again.

  • __Host-hw_session — your session after sign-in: a random identifier (the server keeps only its hash). HttpOnly, Secure, SameSite=Lax. Valid 30 days from the last activity, at most 90 days.
  • hw_dev — a random browser identifier (not sign-in data) used to tell a sign-in from a new device and to notify you of an unknown sign-in. HttpOnly, SameSite=Lax. 400 days.
  • hw_login_attempt — links the sign-in code to the browser that asked for it, so the code cannot be used elsewhere. HttpOnly, SameSite=Strict, only for the sign-in address. 10 minutes.
  • hw_admin — only for HomesWallet's administrators (address /api/admin), 12 hours. Customers never receive it.
  • Cloudflare — at sign-in the Turnstile check (challenges.cloudflare.com) and Cloudflare's network may write or read data necessary for bot protection, under Cloudflare's rules.

Protection against forged requests (CSRF) uses no cookie but a special header on every request and a check of its origin.

The app keeps on your device (it is not sent to us):

  • IndexedDB hw-vault-<number> — the encrypted copy of the household's data and pending changes for working offline;
  • IndexedDB homeswallet-keys — with "Remember this device": a device key that cannot be exported and your key sealed with it;
  • IndexedDB homeswallet-pins, homeswallet-trust, homeswallet-applock — the safety codes you confirmed, the trust state and the app PIN data;
  • localStorage — the language (homeswallet.lang), a dismissed language offer, dismissed cards in the app, the safety code from an invitation link, a referral code (hw_ref) and a pending sign-in (hw_login_pending, 10 minutes);
  • localStorage — the days for which the app has already sent the category accuracy counts (hw:cat-accuracy), so that it does not send them again;
  • sessionStorage — where to take you after sign-in, messages hidden for the session and a notice about the end of the session;
  • Cache Storage — the app's files (service worker) for fast loading and working offline, without personal data.

Signing out closes the session, while the encrypted copy stays so the device can unlock again. To remove the local copy and the keys from a device, choose "Erase the data on the device" in Settings → Devices from another device of yours, or clear the site data in your browser's settings. The language is also kept in your account so it is the same on all devices.