Cookie Policy
Every cookie and local-storage entry we set, why it exists, and how long it lives. You can revoke consent for non-essential entries at any time via the “Cookie settings” link in the footer.
1. Categories we use
We split storage into three categories. Strictly necessary entries are needed to run the site at all and cannot be turned off. Preferences remember your UI choices and are off until you opt in. Analytics covers anonymous usage statistics via Google Analytics 4 and is off until you opt in. We do not use advertising, retargeting, or social-media tracking cookies.
2. Full storage table
Strictly necessary
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
sessionid | Cookie (HttpOnly) | Login session for the app (Django). | Browser session |
csrftoken | Cookie | CSRF protection for app form submissions (Django). | 1 year |
refresh_token | Cookie (HttpOnly) | JWT refresh token for the API (web + mobile). | 7 days |
auth | localStorage | Access token cache during a session. | Browser session |
company | localStorage | Active company selection in the app. | Persistent until logout |
consent | localStorage | This consent record itself (DSGVO Art. 7 evidence). | Until revoked |
Preferences (opt-in)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
ui | localStorage | Sidebar collapsed/expanded, theme overrides, table density. | Persistent |
onboarding-state | localStorage | Multi-step onboarding wizard progress. | Persistent |
onboarding-completed | localStorage | Onboarding finished flag, suppresses re-prompt. | Persistent |
recentCurrencies | localStorage | Most-recently used currency codes in invoice forms. | Persistent |
Analytics (opt-in)
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_* | Cookie (Google Analytics 4) | Anonymous usage statistics. IP-anonymized; no cross-site tracking. | 2 years |
3. What we do not use
- No advertising, retargeting, or remarketing cookies.
- No Facebook Pixel, LinkedIn Insight Tag, or similar social trackers.
- No fingerprinting libraries.
- No third-party A/B testing or session-replay tools.
4. Revoking consent
You can change your mind at any time:
- Click here, or use the same link in the footer of any page.
- Clear the
consententry in your browser's local storage. - Use your browser's “block third-party cookies” setting to opt out of analytics globally.
Revoking analytics consent stops further data collection immediately. To request deletion of analytics data already collected, email [email protected] with “GA4 deletion request” in the subject — Google Analytics' user-deletion API typically completes within 72 hours.
5. Legal basis
Strictly-necessary entries rely on TTDSG § 25 (2) Nr. 2 / DSGVO Art. 6 (1)(f) — they are technically required to deliver the service you asked for. Preferences and analytics rely on your explicit consent under TTDSG § 25 (1) / DSGVO Art. 6 (1)(a). The consent record itself is retained for two years as evidence per DSGVO Art. 7 (1).
6. Changes to this policy
If we add, remove, or repurpose a storage entry, this page is updated and a new banner is shown so you can re-consent under the changed scope. Material changes are also referenced in our changelog.
7. Questions
Email [email protected] — we answer cookie / privacy questions within five working days.