Cookies and storage status

Necessary-only mode is provisionally selected for the invite-only service while these documents remain mock, draft, and not effective. No consent banner or preferences control is shown; the informational storage notice described below is not a consent request. Final classifications and provider-purpose evidence remain pending before effective publication.

On a first visit, an informational notice explains that FinBro uses only necessary storage and links to this page. It has a single dismiss control and no Accept or Reject choice; dismissing it is not consent, creates no consent record, and does not change which storage is used.

Without signing in, the dismissal is kept only in the page's memory: nothing is written to browser storage, and the notice reappears after a full reload or on a new visit. When signed in, the dismissal is stored on the account on FinBro's servers, not in the browser.

Report-panel width and unfinished onboarding progress are kept in memory only and reset on a full reload. The one-tab top-up baseline is an integer written immediately before payment confirmation, read once and removed on return; an abandoned value lasts only for the tab and is overwritten by a later confirmation. Its final classification remains pending.

A clean-browser pre-authentication scan observed FinBro edge and OAuth cookies, Cognito-managed CSRF, session, language and page-data cookies, and one Cognito context-storage key. Visiting Google's identifier page added provider cookies. These observations are not a consent classification.

Before the code fix, deployed unauthenticated checkout, top-up, billing, and bare top-up-return route loads contacted Stripe hosts. No Stripe cookies were observed during those checks. The deferred loading fix is verified locally and on the deployed application: after the 2026-09-14 publication, a clean browser visiting checkout, top-up, billing, bare top-up return, and bare checkout return contacted no Stripe host before authentication or a real return parameter. This reports network activity only and makes no storage or consent classification.

Before the Phase 7A cleanup, an authenticated browser scan observed FinBro session cookies and local preference key names that have since been removed. A sandbox checkout mounted payment and security frames and added provider cookies and iframe session-storage keys; no card data was entered, no charge occurred, and the incomplete session was expired. These observations are not a consent classification.

An authorized sandbox top-up completed as a five-dollar charge and was fully refunded. Test card authentication with a challenge was observed only through an operator workaround because the deployed card-update start returned a web page instead of its expected data response; this is not evidence that the in-product card-update flow works end to end. Temporary test billing state was cleaned up.

Completed wallet use and deployed verification of the card-update flow remain pending. These observations are not a consent classification.

The provisional mode permits only storage needed for user-requested authentication, payment, security, fraud prevention, and routing. Any analytics, advertising, profiling, experimentation, replay, optional persistence, or expanded provider purpose requires consent before loading. Browser controls may remove necessary storage, but doing so can interrupt requested account or payment flows.