Cookies and local storage on taxiteasy.org
Every cookie and local-storage entry we set, why it exists, and how long it lives. You can revoke consent for non-essential entries at any time via the “Cookie settings” link in the footer.
1. Categories we use
We split storage into five categories. Strictly necessary entries are needed to run the site at all and cannot be turned off. Preferences remember your UI choices and are off until you opt in. Analytics covers anonymous usage statistics via Google Analytics 4 and is off until you opt in. Attribution remembers which partner referred you (the ?ref code from a partner link) for 90 days so your sign-up credits them, and is off until you opt in. Email link attribution is one cookie, tie_lc, set by our own redirect when you click the main link of an onboarding or product email from your TaxItEasy account; it is not set by the banner, because the click happens in your email program, and you switch it off by objecting to the measurement (Section 4b of our privacy policy). We do not use advertising, retargeting, or social-media tracking cookies.
2. Full storage table
Strictly necessary
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
sessionid | Cookie (HttpOnly) | Login session for the app (Django). | Browser session |
csrftoken | Cookie | CSRF protection for app form submissions (Django). | 1 year |
refresh_token | Cookie (HttpOnly) | JWT refresh token for the API (web + mobile). | 7 days |
auth | localStorage | Access token cache during a session. | Browser session |
company | localStorage | Active company selection in the app. | Persistent until logout |
consent | localStorage | This consent record itself (DSGVO Art. 7 evidence). | Until revoked |
tie_chat_session | sessionStorage | Random identifier for a conversation with the AI website assistant, so it can follow the thread across your messages. Not linked to any account. | Browser tab session |
tie_chat_history | sessionStorage | The last few turns of that conversation, so the transcript is still on screen if you close and reopen the chat window. | Browser tab session |
tie_chat_maximized | sessionStorage | Whether you enlarged the chat window. | Browser tab session |
Preferences (opt-in)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
ui | localStorage | Sidebar collapsed/expanded, theme overrides, table density. | Persistent |
onboarding-state | localStorage | Multi-step onboarding wizard progress. | Persistent |
onboarding-completed | localStorage | Onboarding finished flag, suppresses re-prompt. | Persistent |
recentCurrencies | localStorage | Most-recently used currency codes in invoice forms. | Persistent |
Analytics (opt-in)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_* | Cookie (Google Analytics 4) | Anonymous usage statistics. IP-anonymized; no cross-site tracking. | 2 years |
Attribution (opt-in)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
ref | First-party cookie (domain .taxiteasy.org) | Remembers the partner code from a ?ref referral link so a later sign-up on app.taxiteasy.org credits the referring partner. Never shared with ad networks; used for nothing else. | 90 days |
utm_source, utm_medium, utm_campaign | sessionStorage | Remembers the campaign a visit came from. If you submit a newsletter sign-up, these values are attached to it and stored with the subscription as its sign-up source (see the Newsletter section of our privacy policy). | Browser session |
Email link attribution
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
tie_lc | First-party cookie (HttpOnly, Secure, SameSite=Lax, path /api/) | Set by our redirect on api.taxiteasy.org when you click the main link of an onboarding or product email from your TaxItEasy account (see Section 4b of our privacy policy). Holds a signed reference to that one email and no address; lets us note that a login within 7 days followed that email. Deleted at that login. Not set by the banner; no longer set for your account once you object to the measurement. | 7 days, or until your next login |
3. What we do not use
- No advertising, retargeting, or remarketing cookies.
- No Facebook Pixel, LinkedIn Insight Tag, or similar social trackers.
- No fingerprinting libraries.
- No third-party A/B testing or session-replay tools.
4. Revoking consent
You can change your mind at any time:
- Click here, or use the same link in the footer of any page.
- Clear the
consententry in your browser's local storage. - Use your browser's “block third-party cookies” setting to opt out of analytics globally.
Revoking analytics consent stops further data collection immediately. To request deletion of analytics data already collected, email [email protected] with “GA4 deletion request” in the subject — Google Analytics' user-deletion API typically completes within 72 hours.
5. Legal basis
Strictly-necessary entries rely on TTDSG § 25 (2) Nr. 2 / DSGVO Art. 6 (1)(f) — they are technically required to deliver the service you asked for. Preferences and analytics rely on your explicit consent under TTDSG § 25 (1) / DSGVO Art. 6 (1)(a). The email-link-attribution cookie tie_lc relies on our legitimate interest (DSGVO Art. 6 (1)(f)) in knowing whether an account email led to a login; you can object at any time (Art. 21, see Section 4b of the privacy policy), and the cookie is then no longer set. The consent record itself is retained for two years as evidence per DSGVO Art. 7 (1).
6. Changes to this policy
If we add, remove, or repurpose a storage entry, this page is updated and a new banner is shown so you can re-consent under the changed scope. Material changes are also referenced in our changelog.
7. Questions
Email [email protected] — we answer cookie / privacy questions within five working days.