Cookie Policy
Version: 7 September 2026
This Cookie Policy explains which cookies and similar technologies Cardify uses, why they are used, how long they are retained, and what choices you have about them. It applies to the Cardify application and its associated website, to the extent the same technologies are used there.
1. Who is responsible?
Cardify is a trade name of Prism Labs BV, with registered office at Mieregemstraat 167, 1785 Merchtem, Belgium, registered with the Crossroads Bank for Enterprises under number 1040.692.808.
For questions about this Cookie Policy, you can contact us at support@gocardify.io.
2. What are cookies and similar technologies?
Cookies are small data files that can be stored on your device through your browser and read again later. They may, for example, be necessary to keep you logged in, to securely authenticate a user, or to protect an application against abuse.
In addition to classic cookies, there are similar technologies, such as localStorage, where information is likewise stored in or read from the browser locally. Throughout this policy, we therefore use the broader term "cookies and similar technologies" where appropriate.
Cardify itself does not use advertising trackers, retargeting pixels, or social media trackers.
3. Overview of the technologies Cardify uses
| Technology | Provider | Purpose | Retention / validity period | Category |
|---|---|---|---|---|
| Laravel session cookie | Cardify | Manages your active session and makes logged-in features work. | 2 hours from your last request within the active session; the validity period is refreshed on every request within that session. | Strictly necessary |
| XSRF-TOKEN (Laravel) | Cardify | Protection against cross-site request forgery and securing forms and requests. | 2 hours from your last request within the active session; refreshed on every request within that session. | Strictly necessary |
| Remember me cookie | Cardify | Keeps you logged in across browser sessions, at your explicit request. | Up to 400 days. Only set when you tick "Remember me" while logging in. | Functional, at the user's explicit request |
| Umami | Cardify — self-hosted | Performance and usage analytics for Cardify. | No cookie; retention of analytics data is governed by the Privacy Policy and server configuration. | Cookieless analytics |
| Theme preference | Cardify | Remembers your light or dark display preference. | localStorage: remains until you change the preference or clear local browser storage. | Functional local storage |
| _GRECAPTCHA / reCAPTCHA technology | Protects registration against automated abuse, spam, and fraudulent registrations through risk analysis. | Managed by Google; the exact technical duration is determined by Google. | Security / fraud prevention |
4. Laravel session cookie
Cardify uses a Laravel session cookie to manage an active user session. This cookie is necessary for features that require a logged-in or active session to work correctly.
The session has a validity period of two hours. Cardify uses what is known as rolling or sliding expiration: every time a request is made within the active session, the validity period is reset to two hours. If no new request is made for two hours, the active session expires.
This cookie is not used for advertising, marketing, or profiling purposes.
5. XSRF-TOKEN
Cardify uses the Laravel XSRF-TOKEN cookie as a technical security mechanism against cross-site request forgery. The token helps prevent unwanted or forged requests from being made on a user's behalf.
This security cookie also has a validity period of two hours and is refreshed on every request within the active session. As a result, the validity period always runs from the most recent active use of Cardify.
The XSRF-TOKEN cookie is necessary for the security of the application and is not used for advertising purposes.
6. Remember me cookie
On the login screen, the user can choose the "Remember me" option. Only when the user actively ticks this option does Cardify set a persistent authentication cookie that allows the user to remain logged in even after closing and reopening the browser.
This remember me cookie can remain on the device for up to 400 days. The cookie is not set if the user does not tick this option.
Cardify uses this cookie solely to provide the "Remember me" function explicitly chosen by the user, and not for analytics, advertising, or profiling.
7. Umami: cookieless analytics
Cardify uses Umami to gain insight into the performance and general use of the application. Umami is self-hosted by Cardify on its own server.
Under the current Cardify configuration, Umami operates without cookies. Cardify does not use Umami for advertising tracking, retargeting, or tracking users across different websites or services.
If the Umami configuration changes in the future, Cardify will reassess whether this Cookie Policy and any consent mechanism need to be adjusted.
8. Preference for light or dark display
When you choose a light or dark display, Cardify stores this preference in your browser's localStorage. LocalStorage is technically not a classic cookie, but it is a form of local browser storage.
This information is used solely to reapply your chosen interface preference the next time you use Cardify. The preference generally remains stored locally until you change it or clear local browser storage.
9. Google reCAPTCHA on the registration page
Cardify uses Google reCAPTCHA on the registration page to help detect and prevent automated registrations, spam, fraud, and other abuse. reCAPTCHA performs a risk analysis for this purpose.
When reCAPTCHA runs, Google may set the _GRECAPTCHA cookie for its risk analysis. Cardify uses reCAPTCHA solely for security and fraud prevention, and not for advertising or marketing profiling.
The reCAPTCHA technology is currently loaded via Google. As a result, your browser may contact the domain google.com. Google manages the technical operation and lifespan of the cookies used by reCAPTCHA. Cardify's Privacy Policy also applies to data processing by reCAPTCHA.
Should the technical implementation of reCAPTCHA change in the future, or activate additional cookies or similar technologies that are not strictly necessary, Cardify will reassess whether prior consent is required.
10. Stripe and payments
Cardify does not load any Stripe scripts, Stripe payment components, or Stripe cookies within the Cardify application itself. Payments and management of payment data take place entirely on Stripe's own servers and domain.
A user is only redirected to Stripe when they choose "Subscribe" or "Manage Billing". At that point, the entire page and URL change to the Stripe environment.
Any cookies or similar technologies set or read by Stripe during that external payment or management flow reside within Stripe's own environment and are governed by Stripe's own cookie and privacy policy. After processing, Cardify only receives the status and transaction information returned server-side by Stripe that is needed to update the subscription status within Cardify.
Cardify itself does not set any Stripe cookies on the Cardify domain.
11. Which cookies do not require prior consent?
Prior consent is not required for strictly necessary cookies where they are necessary to provide a service explicitly requested by the user, or to enable its technical operation and security.
Cardify considers the Laravel session cookie and the XSRF-TOKEN cookie to be strictly necessary for the operation and security of the application. The remember me cookie is only set when the user explicitly requests to stay logged in across sessions by ticking the relevant option.
Cardify nonetheless informs users transparently about these technologies through this Cookie Policy.
12. Consent for non-necessary technologies
If Cardify uses cookies or similar technologies in the future for which prior consent is required, these will not be set or read before the user has made a valid choice.
Such consent must be free, specific, informed, active, and unambiguous, and it must be just as easy to withdraw again.
13. How can you manage cookies and local storage?
You can view, delete, or block cookies, and clear local browser storage, through your browser settings. The exact procedure differs by browser and device.
If you block technically necessary cookies, parts of Cardify may not function, or may not function correctly. If you clear localStorage, your preference for light or dark display may be lost.
If you delete the remember me cookie, Cardify will no longer keep you logged in across browser sessions through that cookie.
14. No advertising tracking
Under the current configuration, Cardify itself does not use advertising trackers, retargeting pixels, or social media trackers to track users across different websites or services for advertising purposes.
Should Cardify introduce such technologies in the future, this Cookie Policy will be updated beforehand, and consent will be requested where required.
15. Personal data and privacy rights
Cookies and similar technologies may involve the processing of personal data. More information about which personal data Cardify processes, for what purposes, on what legal bases, with which recipients, and for what periods, is available in Cardify's Privacy Policy.
For questions or requests regarding your personal data, you can contact us at support@gocardify.io.
16. Changes to this Cookie Policy
Cardify may amend this Cookie Policy when the application, the technologies used, technical configuration, suppliers, or applicable regulations change. The most recent version is made available via Cardify.
Where a change affects technologies for which consent is required, Cardify will, where necessary, ask for a choice or consent beforehand.
17. Contact
Do you have questions about cookies, similar technologies, or this Cookie Policy? Please contact:
Prism Labs BV
Cardify
Mieregemstraat 167
1785 Merchtem, Belgium
Company number (KBO): 1040.692.808
Email: support@gocardify.io