The small print

Cookies and storage

We only use what’s needed for the site to work. There are no advertising or tracking cookies, so there’s no cookie banner.

Last updated 3 October 2026

Cookies

fk.session_token (on the live site, __Secure-fk.session_token): keeps you signed in. Strictly necessary. Lasts until you sign out, or 30 days after your last visit.
fk.session_data (on the live site, __Secure-fk.session_data): a short copy of your sign-in, so pages load quickly. Strictly necessary. Lasts 5 minutes.
fk.state (on the live site, __Secure-fk.state): only while you sign in with Google, to check the answer really comes from the sign-in you started. Strictly necessary. Lasts 5 minutes.
monzo_oauth_state: only for our own staff, while they connect our bank account. Strictly necessary. Lasts 10 minutes.

All of them are only readable by our server, not by scripts on the page.

fk-install-dismissed: if you close the offer to install the app, the date you did, so we don’t ask again for 14 days.
Pause motion: if you pause the moving parts of the home page, that choice, so it stays paused.
If you install the app, your browser keeps copies of our images, styles and an offline page so it opens quickly. It never keeps copies of your account pages or orders.

None of these contain anything about you.

We use Vercel Web Analytics to count page views. It doesn’t use cookies and doesn’t identify you or follow you to other sites.

If we ever want to use a cookie that isn’t strictly necessary, we’ll ask you first, and this page will say what it is.