Home / Cookies
Last updated 26 September 2026. What we store on your device, what we read from it, and what you can switch off.
We use a small number of cookies to keep you signed in and to remember your display preferences. We also read a device fingerprint at three moments — registration, sign-in and purchase — to detect duplicate accounts and payment fraud.
Two optional tools, off until you say yes. With your consent we use Google Analytics 4, to understand how the website and the checkout are used, and the Meta pixel, to measure whether our advertising brings people here. Neither loads, and neither sets a cookie, until you choose it in the cookie banner. You can change your mind at any time from Cookie settings at the bottom of every page. Without your consent, nothing on this site sends your visit to a third party. Details are in section 7.
There is no heat-mapping, no session recording and no A/B testing tool.
We do count visits to the public website, using our own measurement that stores nothing on your device. There is no cookie and no identifier that follows you: the key we use to avoid counting one person twice is derived from a value that changes every day, so the same browser is a different, unlinkable key tomorrow. Your IP address is never stored. Details are in section 3.
The rules here are not only about cookies. Both UK and EU law regulate storing information on your device or reading information already on it, whatever the technique. That covers cookies, browser storage and device fingerprinting alike, so all three are described below.
| Name | Why | Type | Lifetime |
|---|---|---|---|
fundedportal-session | Ties a page request to your visit; needed for forms to work | Strictly necessary | 2 hours |
XSRF-TOKEN | Lets a form prove the submission came from you and not from another site | Strictly necessary | 2 hours |
fp_ses | Carries your sign-in across the website and the trading panel, so moving between them does not ask you to sign in again. It holds your access token | Strictly necessary | Same as the token: 30 days if you chose to stay signed in, otherwise 12 hours |
fp_onay | Remembers the choice you made in the cookie banner, so we do not ask on every page and so the optional tools stay off if you said no. It holds your two yes/no answers and the time you gave them — nothing that identifies you | Strictly necessary | 6 months, then we ask again |
All four are set with Secure and SameSite=Lax. The first two are additionally HttpOnly, so page scripts cannot read them; fp_ses and fp_onay are not — they are written by the page itself in order to be readable by both the website and the panel, and they are scoped to .fundedportal.com so both can see them. Those four are the only cookies set without your consent. There is no preference cookie, because the appearance of these pages is fixed rather than chosen.
There is no third-party embedded content on the marketing pages. The only third parties that can set a cookie here are the optional tools in section 7, and only after you allow them.
We measure how many people reach the public website and which pages they open. It runs on our own servers and it is deliberately built so that it needs no consent — under both UK/EU and Turkish guidance, audience measurement is exempt when it is first-party, aggregate and cannot follow a person around.
What is recorded for each page view: the date, the page address, the entry page for that visit, a coarse device class (phone, tablet or desktop), the first two letters of your browser language, your country, the domain that linked you here, and any campaign tags in the address you clicked.
What is not recorded, and cannot be reconstructed:
Detailed records are deleted after 90 days; only the daily totals are kept after that. Because there is no lasting identifier, we cannot tell you whether a particular visit was yours, and we cannot single out your visits to delete them — the same design that protects you also limits what we could look up on request.
The panel at trader.fundedportal.com stores more, because it has to: your sign-in session, your interface preferences and a local cache so charts and tables do not reload from scratch on every screen. All of it exists to deliver the service you asked for.
The panel sets one cookie — fp_ses, the shared sign-in cookie described in section 2 — and keeps everything else in your browser's local storage, which stays on your device and is not attached to the requests it sends us. What is held in local storage falls into four groups:
| Group | What it holds | Lifetime |
|---|---|---|
| Sign-in | Your access token and the account you last had open, so a page refresh does not sign you out | Until the token expires — 30 days if you chose to stay signed in, otherwise 12 hours — or until you sign out or clear site data |
| Preferences | Language, display currency, time zone, light or dark appearance, and whether side panels are open | Until you change or clear them |
| Workspace | Watchlists, chart indicators and drawings, order-ticket layout, position-list view | Until you change or clear them |
| Notices | Which announcements you have already dismissed, so they are not shown again | Until you clear site data |
None of it is analytics, and none of it is shared with a third party. Clearing site data for trader.fundedportal.com removes all four groups; you will be signed out and your workspace returns to its defaults.
The panel also reads fp_onay, so the choice you made on the website applies there too. If you allowed them, the optional tools in section 7 run on the checkout as well — that is where they learn that a checkout was started, an order placed or a purchase completed.
This is the part most sites hide in a footnote, so here it is in full.
When you register, sign in or buy, we compute a value from your browser and device configuration and store that value — not the underlying details — together with your IP address and browser identification string.
To detect one person holding accounts that the rules require to be one per person, and to detect payment fraud. It is the mechanism behind the account-matching described in our privacy policy.
Reading a device fingerprint engages the same rule as setting a cookie. We rely on it being necessary to deliver a service you asked for — an assessment whose result means something depends on the one-account-per-person rule actually holding.
We will not pretend this is beyond argument. Fraud prevention serves us as well as you, and a regulator could take the view that consent is required.
Our recorded position has two parts, because two different rules apply to the same act. Reading the value from your device is done on the basis that it is strictly necessary to deliver the service you asked for — an assessment whose result means anything depends on the one-account-per-person rule actually holding. Everything we do with the value afterwards — storing it, matching it against other accounts, acting on a match — is done on the basis of our legitimate interest in keeping one person to one account and preventing payment fraud, which is the same basis recorded in the privacy policy.
We have written down the balancing test behind that second limb and will give it to you if you ask. If a regulator or a court tells us the first limb needs consent instead, we will ask for consent rather than argue about it.
We do not use the fingerprint for advertising, analytics or profiling for any purpose other than the two named above. If we ever wanted to, that would require your consent and we would ask for it.
Signals from this data can suspend an account or hold a payout automatically. You can ask a person to review any such decision — how to do that is on the complaints page, and your rights are set out in the privacy policy.
Everything in sections 2 to 5 is either strictly necessary, a preference you chose yourself, or the visit counting in section 3, which needs no consent because it writes nothing to your device, keeps no lasting identifier and shares nothing with anyone. The tools below are different: they store an identifier on your device and send data to another company. So they only run if you say yes, and the banner asks before anything loads — until you answer, neither company is contacted at all.
| Tool | Cookies | What it is for | Lifetime |
|---|---|---|---|
| Google Analytics 4 Google Ireland Limited, with Google LLC Category: analytics | _ga, _ga_NVC2D7DX1K | Tells one browser from another so we can see how many people come back, which pages they read, which campaigns brought them and whether a visit led to a checkout | 13 months |
| Meta pixel Meta Platforms Ireland Limited, with Meta Platforms, Inc. Category: advertising measurement | _fbp, and _fbc only if you arrived by clicking one of our ads | Measures whether people who saw or clicked our ads on Facebook or Instagram went on to visit or buy, and lets us show our ads again to people who have visited | 90 days |
| Google, only when you allow both analytics and advertising measurement Category: advertising measurement | _gcl_au | Connects a click on one of our Google ads to a later purchase, so we can tell which ads work | 90 days |
What they receive: the pages you open, how you arrived (the linking site, campaign tags and ad-click identifiers), your browser and device type, an approximate location derived from your network address, and on the checkout the fact that you started a checkout, placed an order or completed a purchase, with the plan, amount and currency. They do not receive your name, email address, phone number, identity documents, payment details or trading activity, and we have switched off the features that would try to collect those automatically.
Legal basis: your consent — for storing and reading the identifier on your device, and for the processing that follows. Google processes the analytics data for us under its data processing terms, and we have switched off the options that would let Google use it for its own purposes. For the Meta pixel, Meta and we are jointly responsible for collecting and sending the data; what Meta does with it afterwards, including using it to show you ads, is Meta's responsibility under its own privacy policy. Both companies may process the data in the United States; that transfer relies on the UK Extension to the EU–US Data Privacy Framework, under which both Google LLC and Meta Platforms, Inc. are certified.
Changing your mind: open Cookie settings at the bottom of any page. Withdrawing is as easy as agreeing. When you withdraw, we delete these cookies from our domains and the tools stop loading; data sent before you withdrew is not affected, because withdrawing consent does not work backwards.
The optional tools in section 7 are switched on and off from Cookie settings at the bottom of every page; saying no changes nothing else about the site or your account. You can also clear or block cookies and site data in your browser at any time. Blocking the session cookie means sign-in stops working — that is a technical consequence, not a penalty.
You cannot clear a device fingerprint the way you clear a cookie, because nothing is written to your device to be cleared. If you object to it, write to support@fundedportal.com; we will consider the objection and tell you the outcome and our reasons.
Cookies expire as shown above. Google Analytics keeps the event data it collects for us for 14 months and then deletes it; Meta keeps pixel data under its own policy. Fingerprint records and the associated IP and browser strings are kept for 24 months from the last time we saw the value, and are then deleted — unless they are attached to an open investigation or to a record we are required to retain. The period is what it is because duplicate-account patterns typically surface across successive purchases rather than within one; keeping the records shorter would defeat the purpose, and keeping them longer would not add anything.
Apart from the optional tools in section 7, which run only with your consent, the data described here stays with us and our hosting provider. It is not sold, and it is not shared with data brokers. Our servers are in France, operated on our behalf by Contabo GmbH, a provider established in Germany. Because that is inside the EEA, the transfer out of the United Kingdom relies on the UK's adequacy regulations for the EEA rather than on standard contractual clauses.
If we start using a technology that is not listed here, we update this page before we switch it on. Each version is dated and retained, so it is possible to establish what you were told and when.
Questions about anything on this page: support@fundedportal.com. Our supervisory authority is the Information Commissioner's Office, and you can complain to them whether or not you come to us first.