Introduction
This Cookie Policy explains how Cognyfai Limited ("Heimly") uses cookies and similar technologies on the Heimly platform (heimly.ng and associated applications). Read this alongside our Privacy Policy.
What Are Cookies?
Cookies are small text files stored on your device by your web browser when you visit a website. They help websites recognise your device, remember your preferences, and improve your experience. Similar technologies include web beacons, pixels, local storage, and session storage — we refer to all of these collectively as "cookies" in this policy.
Cookies We Use
Strictly Necessary Cookies
These cookies are essential for the Platform to function. They cannot be disabled.
- access_token / refresh_token — HTTPOnly session cookies that maintain your authenticated session securely. They are never accessible to JavaScript and expire automatically (access token: 15 minutes; refresh token: 7 days).
- csrftoken — Django CSRF protection token, prevents cross-site request forgery.
Functional Cookies
These cookies enable enhanced features and personalisation. Disabling them may affect your experience.
- org_id — remembers which organisation context you last selected in the dashboard.
- Preferences — stores your locale, dashboard layout preferences, and notification settings.
Analytics Cookies
We use analytics to understand how the Platform is used so we can improve it. These tools may set cookies on your device, and are loaded only if you accept analytics cookies in the cookie banner. Analytics is a separate choice from marketing, so you can accept one and refuse the other.
- Google Analytics 4 (GA4) — loaded from
googletagmanager.com when enabled. Measures page views, navigation paths, device/browser type, and interaction events. We enable IP anonymisation in our GA4 configuration. Cookies may include _ga and _gid. Data is processed by Google LLC. See Google Privacy Policy and our Google Analytics section in the Privacy Policy. - Vercel Analytics — when deployed on Vercel, measures page views and performance metrics. Data is anonymised and not shared with advertisers.
Marketing Cookies
We use marketing cookies to measure our advertising and to show relevant ads to people who have visited the Platform. These are set only if you accept them in the cookie banner, and never before.
- Meta Pixel — loaded from
connect.facebook.net. Measures which of our Facebook and Instagram ads lead to activity on the Platform, such as viewing a listing, contacting an agent, or subscribing to a plan, and allows us to show ads to people who have used the Platform before. Cookies may include _fbp on this site and fr on Facebook's own domain. Data is processed by Meta Platforms, Inc.
Where you are signed in, we also send Meta a cryptographically hashed version of your email address and phone number so it can tell whether an ad was shown to you. Meta receives the hash, not the address or number itself. See Meta Privacy Policy and our Meta Pixel section in the Privacy Policy.
You can opt out of these cookies at any time using the browser controls described under Managing Cookies below, or through your Meta ad preferences. Blocking them does not affect your ability to use the Platform.
Third-Party Cookies
Some features of the Platform load content from third-party services that may set their own cookies, subject to their privacy policies:
- Paystack — payment processing. Cookies used to prevent fraud and secure your transaction. See Paystack Privacy Policy.
- Google (Sign in with Google) — when you authenticate via Google OAuth, Google may set cookies during the sign-in flow. We store your session using Heimly HTTP-only cookies after login completes. See Google Privacy Policy and our Google User Data section.
- Meta (Facebook and Instagram) — the Meta Pixel described under Marketing Cookies above loads a script from
connect.facebook.net and sends measurement requests to facebook.com, which may read or set Meta's own cookies on that domain. See Meta Privacy Policy.
Managing Your Cookie Preferences
On Heimly. The first time you visit, a banner asks which categories you accept. Nothing beyond essential cookies is set until you choose, and analytics and marketing can be accepted or refused independently. Refusing them does not limit any part of the Platform.
You can change your mind at any time using the Cookie preferences link in the footer of every page. Turning a category off stops the relevant service immediately and clears the cookies it set.
In your browser. Independently of the above, most browsers allow you to:
- View and delete cookies stored on your device.
- Block cookies from specific websites.
- Block all third-party cookies.
- Clear all cookies when you close the browser.
Please note that disabling strictly necessary cookies will prevent you from logging in and using the Platform. Browser-level cookie controls are separate from the in-app notification settings in your account.
For browser-specific instructions visit: allaboutcookies.org. To opt out of Google Analytics specifically, you may use the Google Analytics opt-out browser add-on.
Cookie Retention Periods
- Session cookies — deleted when you close your browser.
- access_token — expires after 15 minutes of inactivity (automatically refreshed while you are active).
- refresh_token — expires after 7 days.
- Analytics cookies (GA4) — up to 24 months (
_ga); session-level cookies may expire sooner. - Analytics cookies (general) — up to 24 months, anonymised where configured.
Updates to This Policy
We may update this Cookie Policy to reflect changes in technology or applicable law. We will post the updated policy on this page with a revised date. For significant changes, we will notify you via a banner on the Platform.