1. Summary
We only use cookies and local storage that are strictly necessary to provide the service you asked for — signing in, security, and remembering your settings. We do notuse analytics, advertising, tracking or social media cookies, so we don't show a consent banner. If that ever changes we will ask for your consent first.
2. What we use
| Name | Purpose | Type | Duration |
|---|---|---|---|
authjs.session-token | Keeps you signed in (encrypted session). | Strictly necessary | Session / up to 30 days |
authjs.csrf-token | Protects sign-in forms against cross-site request forgery. | Strictly necessary | Session |
authjs.callback-url | Remembers where to send you after signing in. | Strictly necessary | Session |
authjs.pkce.code_verifier, authjs.state | Secures the Google / GitHub sign-in handshake (only if you use them). | Strictly necessary | 15 minutes |
current_org | Remembers which workspace you are working in. | Strictly necessary | 1 year |
theme (local storage, not a cookie) | Remembers your light/dark mode choice on this device. | Strictly necessary (preference you requested) | Until cleared |
sidebar_state | Remembers whether the app sidebar is collapsed. | Strictly necessary (preference you requested) | 7 days |
On secure (HTTPS) connections, the sign-in cookie names may be prefixed with __Secure- or __Host-.
3. Third-party pages
When you upgrade to Pro, or when your client pays an invoice online, you are redirected to a checkout page hosted by Stripe. Stripe sets its own cookies there for fraud prevention and payment processing, governed by Stripe's cookie policy. The same applies to Google and GitHub if you choose to sign in with them.
4. Managing cookies
You can block or delete cookies in your browser settings, but because ours are strictly necessary, signing in and using the app will not work without them.
5. Contact
Questions? Email [privacy@onlyinvoicing.com] or read our Privacy Policy.