Introduction
This Cookie Policy explains how Cognyfai Limited ("Heimly") uses cookies and similar technologies on the Heimly platform (heimly.ng and associated applications). Read this alongside our Privacy Policy.
What Are Cookies?
Cookies are small text files stored on your device by your web browser when you visit a website. They help websites recognise your device, remember your preferences, and improve your experience. Similar technologies include web beacons, pixels, local storage, and session storage — we refer to all of these collectively as "cookies" in this policy.
Cookies We Use
Strictly Necessary Cookies
These cookies are essential for the Platform to function. They cannot be disabled.
- access_token / refresh_token — HTTPOnly session cookies that maintain your authenticated session securely. They are never accessible to JavaScript and expire automatically (access token: 15 minutes; refresh token: 7 days).
- csrftoken — Django CSRF protection token, prevents cross-site request forgery.
Functional Cookies
These cookies enable enhanced features and personalisation. Disabling them may affect your experience.
- org_id — remembers which organisation context you last selected in the dashboard.
- Preferences — stores your locale, dashboard layout preferences, and notification settings.
Analytics Cookies
We use analytics to understand how the Platform is used so we can improve it. These tools may set cookies on your device, and are loaded only if you accept analytics cookies in the cookie banner. Analytics is a separate choice from marketing, so you can accept one and refuse the other.
- Google Analytics 4 (GA4) — loaded from
googletagmanager.com when enabled. Measures page views, navigation paths, device/browser type, and interaction events. Google states that Analytics does not log or store IP addresses: an address is used to derive an approximate location and is then discarded. Cookies may include _ga and _gid. Data is processed by Google LLC. See Google Privacy Policy and our Google Analytics section in the Privacy Policy. - Vercel Analytics — when deployed on Vercel, measures page views and performance metrics. Data is anonymised and not shared with advertisers.
Marketing Cookies
We use marketing cookies to measure our advertising and to show relevant ads to people who have visited the Platform. These are set only if you accept them in the cookie banner, and never before.
- Meta Pixel — loaded from
connect.facebook.net. Measures which of our Facebook and Instagram ads lead to activity on the Platform, such as viewing a listing, contacting an agent, or subscribing to a plan, and allows us to show ads to people who have used the Platform before. Cookies may include _fbp on this site and fr on Facebook's own domain. Data is processed by Meta Platforms, Inc.
Where you are signed in, we also send Meta a cryptographically hashed version of your email address and phone number so it can tell whether an ad was shown to you. Meta receives the hash, not the address or number itself. See Meta Privacy Policy and our Meta Pixel section in the Privacy Policy. - Google Ads conversion measurement: part of the same Google tag described under Analytics Cookies, configured separately and loaded only if you accept marketing cookies. It records which of our Google and YouTube ads led to a sign up or an enquiry. When you arrive from an ad, the click identifier in the link is stored in a first-party cookie on this site so a later sign up can be matched back to that ad. Cookies are named
_gcl_au, _gcl_aw and other names beginning _gcl_. Data is processed by Google. We send Google no name, email address or phone number with a conversion.
You can opt out of these cookies at any time using the browser controls described under Managing Cookies below, or through your Meta ad preferences. Blocking them does not affect your ability to use the Platform.
Third-Party Cookies
Some features of the Platform load content from third-party services that may set their own cookies, subject to their privacy policies:
- Paystack — payment processing. Cookies used to prevent fraud and secure your transaction. See Paystack Privacy Policy.
- Google (Sign in with Google) — when you authenticate via Google OAuth, Google may set cookies during the sign-in flow. We store your session using Heimly HTTP-only cookies after login completes. See Google Privacy Policy and our Google User Data section.
- Meta (Facebook and Instagram) — the Meta Pixel described under Marketing Cookies above loads a script from
connect.facebook.net and sends measurement requests to facebook.com, which may read or set Meta's own cookies on that domain. See Meta Privacy Policy.
Managing Your Cookie Preferences
On Heimly. The first time you visit, a banner asks which categories you accept. Nothing beyond essential cookies is set until you choose, and analytics and marketing can be accepted or refused independently. Refusing them does not limit any part of the Platform.
You can change your mind at any time using the Cookie preferences link in the footer of every page. Turning a category off stops the relevant service immediately and clears the cookies it set.
In your browser. Independently of the above, most browsers allow you to:
- View and delete cookies stored on your device.
- Block cookies from specific websites.
- Block all third-party cookies.
- Clear all cookies when you close the browser.
Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Browser-level cookie controls are separate from the in-app notification settings in your account.
For browser-specific instructions visit: allaboutcookies.org. To opt out of Google Analytics specifically, you may use the Google Analytics opt-out browser add-on.
Cookie Retention Periods
- Session cookies — deleted when you close your browser.
- access_token — expires after 15 minutes of inactivity (automatically refreshed while you are active).
- refresh_token — expires after 7 days.
- Analytics cookies (GA4) — up to 24 months (
_ga); session-level cookies may expire sooner. - Analytics cookies (general) — up to 24 months, anonymised where configured.
- Advertising measurement cookies: up to 90 days (
_gcl_au, _gcl_aw and other _gcl_ names).
Updates to This Policy
We may update this Cookie Policy to reflect changes in technology or applicable law. We will post the updated policy on this page with a revised date. For significant changes, we will notify you via a banner on the Platform.
