2.Local storage
Local storage stays in your browser until you sign out or clear your browser data. It is never sent to anyone; the page reads it. Finmind keeps:
- ef-auth: your sign-in session when you ticked "Remember me" (an access token valid for 30 minutes and a refresh token valid for 30 days; 7 days in the Telegram Mini App), so you stay signed in after closing the browser. Without "Remember me" it is kept in session storage instead (below). Removed when you sign out. ef-auth-refresh-lock is a marker so that only one open tab renews the session at a time. ef-auth-tab is a marker with no token in it: it says a session kept in session storage may be open in another tab, so a new tab can ask that tab for it.
- ef-theme: the theme you chose: dark, light, or the one your device uses.
- ef-hide-balances: that you chose to hide the amounts and quantities of your own Finmind account on this device (the eye button in the header, or in the profile menu on a phone; your percentages stay visible). Removed when you show them again.
- ef-onboarding-surface: whether the Get Started card was showing on your dashboard on this device, how many steps it listed and the title of its next step, with your Finmind account's number and nothing else, so the page keeps the card's place while it loads and does not jump when the card appears. It changes each time the card changes.
- ef-sidebar-collapsed and ef-nav-recent: whether the sidebar is collapsed, and the pages you opened recently, for the navigation menu.
- ef-org-context: for a member of an organisation account, whether this browser last opened your personal Finmind account or one of your organisation accounts, so the app opens where you left off. It is the organisation's identifier only, never its data.
- ef-terminal-watchlist: the symbols on your terminal watchlist.
- ef.dismissedAnnouncements: the platform announcements you dismissed.
- fm_pending_ref: a referral code you arrived with, kept until you register.
- fm_cookie_notice: that you have seen the storage notice, so it is not shown again.
- fm_last_signin_provider: whether you last signed in with Google or Telegram on this device, so that button comes first next time. It holds the provider's name only.
- tf: and per-view keys: the chart timeframe and the cards-or-list view you chose on a page, and the brokerage account you last chose to look at on your Profitability card (kept under your own Finmind account's number, so another person on this browser does not see it).
- fm-tg-session and fm-tg-pref:: in the Telegram Mini App only, which Telegram user this session belongs to and the Mini App's own preferences (such as its language).
- fm_bio_: in the Telegram Mini App only, once you turn on Face ID or fingerprint for a phone: a record for that phone, kept in Telegram's cloud storage for the Mini App (or under fm-tg-pref: on the device when that is not available). It holds the number of the phone's enrolment, an identifier Finmind made for the phone and your two choices (confirm each order, lock the app when it reopens), never a secret. The secret that Face ID or the fingerprint releases is kept by Telegram in the phone's secure storage and leaves it only after the phone's own check; our server keeps only a hash of it. Removed when you turn it off on that phone.
3.Session storage
Session storage is cleared when you close the tab. Finmind keeps in it short-lived steps of a sign-in and per-tab dismissals:
- ef-auth: your sign-in session when you did not tick "Remember me" (an access token valid for 30 minutes and a refresh token valid for 24 hours), so closing the browser signs you out. Your open Finmind tabs pass it to each other inside the browser; it is never sent anywhere else. Removed when you sign out.
- fm.emailChallenge, oneid.flow, oneid.reauth and oneid.reauth.owner: the step you are in while confirming an email address, a second factor or a OneID sign-in. Removed when you sign out.
- fm_locale_chosen: that you switched the language in this tab, so it wins over the language stored on your profile.
- fm_tg_signin_link: an opaque, single-use token kept for up to 10 minutes after a Telegram sign-in was refused because that Telegram is your notification chat, so your next sign-in can also make it a way to sign in.
- fm_social_twofa: a second-factor step handed from the registration page to the sign-in page after a Google or Telegram sign-in.
- ef.onboardingReminded and fm.verifyEmailBannerDismissed: banners you closed or were shown in this tab. fm.shellNoticesExpanded: that you opened the waiting notices in this tab. fm.essentialsGrace: that you opened or hid the Essentials notice in this tab.
- fm.trade.openChecks: the identifiers of orders whose outcome the page is still checking with your broker.
- fm.trade.brokerList: whether you opened your broker's own order list under Orders on the trade page.
- fm.seenPages: a short code for each page whose opening animation has already played in this tab (the home page's introduction, a chart drawing, a first count of a total), at most 100, so a page you come back to shows its finished state instead of playing the animation again. It holds codes, never page addresses.
- fm-tg-cache:: in the Telegram Mini App only, a short-lived cache of the screen you just read.
4.Third-party scripts and embeds
No script from anyone else runs on our pages, except where a feature needs it, and only on the pages that offer that feature:
- Google Identity Services (accounts.google.com), which draws the "Sign in with Google" button. Loaded only on the sign-in and registration pages and under Sign-in methods in Settings, and only after the server says Google sign-in is offered; it is not loaded anywhere else. The button is a Google frame: Google may set its own cookies inside it under Google's privacy policy.
- Telegram login (oauth.telegram.org or telegram.org), which opens the "Sign in with Telegram" window. Loaded on the same pages, only when the server offers Telegram sign-in.
- Telegram Web App script (telegram.org), which every Telegram Mini App needs. Loaded only on /tg, inside Telegram.
- Looker Studio (datastudio.google.com), the exchange's own dashboard, which the Top liquid stocks page can show as a Google frame. It is not needed for Finmind to work, so it is loaded only when you press "Show the dashboard here" on that visit; the choice is not remembered, and until you press it nothing is requested from Google. Once loaded, Google may set cookies inside that frame under its own policy.
Fonts are served from finmind.uz itself, not from Google Fonts. There is no analytics or advertising script, no pixel and no fingerprinting.
5.Your choices
Everything above is needed for the part of the service it belongs to, so there is nothing to opt into or out of, and we do not ask for consent for it. What you can do:
- Sign out to remove your session from this browser.
- Clear this site's data in your browser to remove everything else; the language and theme return to their defaults.
- Block the Google or Telegram scripts with a browser setting or an extension: email sign-in keeps working and the page says the button could not load.
- Open this page from the "Cookie policy" link in the footer at any time. The "Cookie settings" link shows the storage notice again.
If we ever add storage that is not needed for the service to work, we will ask for your consent before setting it, with equal choices to accept or refuse, and this page will list it.
6.Changes to this policy
We update this page whenever the code changes what it stores. The date at the top shows the latest version.
7.Contact
Questions about storage or privacy: Support in the app (Settings, then Support), the contact form on the home page, or finmind_support@protonmail.com.