Cookie Policy
What cookies we set, what they do, and how to control them.
Effective October 25, 2026 · Last updated October 25, 2026
1. What are cookies?
Cookies are small text files stored on your device by your browser. We also use related technologies such as local storage and session storage. Section 3 lists those separately, because they are not cookies and your browser’s cookie controls do not clear them.
2. Cookies we set
| Cookie / token | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
| sb-<project-ref>-auth-token (and .0 / .1 chunks) | Strictly necessary | Authentication. Keeps you signed in to your account. The name carries our Supabase project reference; a long session is split across numbered chunks. | 400 days | Supabase Auth |
| sb-<project-ref>-auth-token-code-verifier | Strictly necessary | Completes any sign-in that finishes by following a link or a redirect back to this site: Google sign-in, the confirmation link on a new email account, a password reset. It is removed when the flow finishes. If you abandon the flow it is left behind until it expires. | 400 days | Supabase Auth |
That table is the complete list of cookies set by this site. We do not use third-party advertising or cross-context behavioral-advertising cookies, and we do not embed social-media trackers.
Stripe sets its own __stripe_mid and __stripe_sid cookies for fraud prevention, but it sets them on Stripe’s own domain, not on ours. No Stripe script runs on this site — checkout is a redirect to a page Stripe hosts, and those cookies are set there. They are covered by Stripe’s privacy policy, not this one.
We measure how the site is used, but only if you agree. Once you click Accept on the cookie banner, the Vercel Web Analytics script is loaded on every page of this site; it sets no cookie in your browser. Before you accept, and after you decline, it is not loaded. Whether it actually records anything is a setting in our Vercel dashboard rather than something in this code, so we cannot promise from the code alone that measurement is on or off at any moment. Vercel is listed in our Subprocessor List. We do not run Google Analytics.
Every cookie in the table is strictly necessary to sign you in or to take a payment, so we set them without asking. Measurement is different. On your first visit a banner at the bottom of the page asks whether we may measure your visit. Until you click Accept, nothing that measures you runs: the Vercel script is not loaded, no page-view or event record is sent to us, and none of the keys marked “Only after you accept” in Section 3 is written. If you click Decline, we store only your answer, and we remove any measurement keys an earlier visit left in your browser. You can change your answer at any time with “Cookie settings” in the site footer or in Section 4 below.
3. Local storage and session storage
Separately from cookies, this site writes the keys below to your browser’s own storage. Local storage survives until you clear it; session storage is discarded when you close the tab. Clearing cookies does not clear either one — use your browser’s “clear site data” control for that.
| Key | Store | Purpose | Written |
|---|---|---|---|
| chart_of_accounts_consent | Local storage | Your answer to the cookie banner: accepted or declined. Strictly necessary, because without it the banner would return on every page. It holds only that one word and is never sent to us. | When you answer the banner |
| chart_of_accounts_visitor | Local storage | A random visitor id that persists across visits. Sent with page-view records and sign-up attempt records, and joined to your account if you sign up. | Only after you accept |
| chart_of_accounts_first_touch, chart_of_accounts_attribution, chart_of_accounts_utm | Local storage | Which campaign, link or search first brought you here, the full landing URL, and the page that referred you. | Only after you accept |
| analytics_events | Local storage | A copy of your 100 most recent activity records, kept for diagnostics. Not only page views: a record is written when you click a call to action, sign in, start the free trial, or use a feature, and it carries the page you were on and the campaign parameters you arrived with. Older records drop off as new ones arrive. | Only after you accept |
| chart_of_accounts_events | Local storage | A copy of the conversion events recorded in this browser, kept for diagnostics. This list has no size limit and is only cleared when you clear site data. | Only after you accept |
| chart_of_accounts_session | Local storage | A random id attached to the conversion events above. Despite the name it is written to local storage, so it lasts until you clear site data rather than ending with the tab. | Only after you accept |
| analytics_session_id | Session storage | Groups the pages you view in one sitting. This is the one that ends when you close the tab. | Only after you accept |
| oauth_return_url | Local storage | Returns you to the page you started from after connecting QuickBooks Online. | When you use the feature |
| signup_attribution_fired | Session storage | Records that this browsing session has already linked your visitor id to your account, so it is not sent again on every page. | Only after you accept |
| demo_start_fired | Session storage | Records that this browsing session has already counted the start of your free trial, so a reload does not count a second one. | Only after you accept |
| confirm-business-context-open, optimize-business-context-open, customize-business-context-open, visualize-business-context-open | Local storage | Remembers whether the business-context panel was left open or collapsed, separately on each of the four workflow screens. | When you use the feature |
One of these deserves to be called out. The visitor id is a durable, random identifier for your browser. It is created on the first page you view after you click Accept, never before, and it is sent to us with each page-view record along with the page, the page that referred you, and the campaign parameters in the link you followed. It is also sent, with the same details, when you submit the sign-up form, together with whether you used email or Google, and when the form shows an error, together with a short code for the kind of error. We never record what you type into the form. If you later create an account, we attach your account to that visitor id, which links the pages you viewed before signing up to your name and email.
One more item can appear in your browser’s local storage, and it is not ours. Our sign-up, sign-in and password reset pages show a “Verify you are human” box, which Cloudflare serves in a frame from its own domain, challenges.cloudflare.com. Cloudflare’s script in that frame stores one item, cf.turnstile.u, under Cloudflare’s domain, and it stays after you leave the page. We do not write it or read it, and Cloudflare’s documentation does not say what it holds. The box sets no cookie. It gives our form a single-use token instead, and Cloudflare sets a cookie only for sites that turn on an option called pre-clearance, which we do not use. The box runs only while we have it switched on. Cloudflare is listed in our Subprocessor List, and its Turnstile Privacy Addendum covers what Cloudflare does with it.
4. How to control cookies
You can refuse, delete, or block cookies through your browser settings. Disabling strictly necessary cookies will break sign-in and checkout; we cannot operate the Service without them. Cookie controls do not touch the local storage and session storage keys in Section 3 — clearing those needs your browser’s site-data control, or you can email us and we will delete the records we hold against your visitor id.
To change your answer about measurement, use . Choosing Decline also removes the measurement keys from your browser.
Most browsers offer per-site controls:
5. Do Not Track & Global Privacy Control
We do not read Do Not Track or Global Privacy Control signals. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing for either signal to opt you out of.
6. Changes
If we add or remove cookies in a way that meaningfully changes the information we collect, we will update this Cookie Policy and the “Last updated” date at the top.
7. Questions
Cookie questions: legal@chartofaccounts.ai.