Back to Seris

Cookie & Storage Policy

Last updated: 26 September 2026

This policy explains how Seris uses cookies, local storage, session storage, and other browser storage mechanisms. While Singapore does not have a dedicated cookie law, the Personal Data Protection Act 2012 (PDPA) applies to any storage mechanism that collects or processes personal data.

1. What We Use

Seris primarily uses browser storage APIs rather than traditional HTTP cookies. Here is a breakdown of the storage mechanisms we use:

Storage TypePurposeDurationContains Personal Data
Firebase Auth TokensAuthentication — keeps you signed inUntil sign-out or token expiry (1 hour, auto-refreshed)Yes (user ID, email)
IndexedDB (seris-crypto)Stores your encryption key for portfolio data decryptionPersistent until clearedYes (cryptographic key)
IndexedDB (WebLLM)Caches on-device AI model files for offline usePersistent until clearedNo
localStorageUI preferences, theme settings, onboarding state, behaviour tracking queuePersistent until clearedMinimal (user ID for event correlation)
sessionStorageTemporary UI state (e.g., preventing duplicate tip modals within a session)Until tab is closedNo
Service Worker CacheCaches app assets for offline/PWA functionalityManaged by Next.js PWANo

2. Essential vs Non-Essential

All storage mechanisms used by Seris are essential for the functioning of the Service:

  • Authentication tokens are required to keep you signed in and authorise API requests
  • Encryption keys are required to decrypt your portfolio data if encryption is enabled
  • On-device AI cache is required for the on-device AI feature to function without re-downloading models
  • Preference storage is required to remember your settings between sessions

Seris does not use any third-party advertising cookies, social media tracking pixels, or non-essential analytics cookies. We do not use Google Analytics or similar third-party tracking services.

3. Third-Party Storage

The following third-party services may set their own storage:

  • Firebase Authentication (Google): Sets authentication tokens in IndexedDB and localStorage to manage your sign-in session

We do not control the storage set by third-party services. Please refer to Google's Privacy Policy for details on how Firebase handles data.

4. On-Device AI Data

When you use on-device AI features, AI model files are downloaded and cached in IndexedDB. These files can be several hundred megabytes. This data does not contain any personal information — it consists solely of AI model weights. All AI inference using on-device models runs entirely in your browser; no data is sent to external servers.

5. Managing Storage

You can manage browser storage through the following methods:

  • Sign out: Clears authentication tokens
  • Browser settings: Clear cookies and site data for Seris through your browser's privacy settings
  • DevTools: Use your browser's Application tab to inspect and delete specific storage entries
  • Unregister Service Worker: Remove cached PWA assets through browser settings or DevTools

Note: Clearing IndexedDB will remove your stored encryption key. If you have encrypted portfolio data, you will need to re-enter your passphrase to regenerate the key.

6. Changes to This Policy

We may update this Cookie & Storage Policy from time to time to reflect changes in our storage practices. We will update the "Last updated" date at the top of this page.

7. Contact

For questions about this Cookie & Storage Policy, contact our Data Protection Officer at [email protected].

Terms of UsePrivacy Policy