Cookie Policy

1. What cookies do

Cookies are small values your browser stores for a website and sends back with later requests. They let Spendwell recognise a signed-in session and help protect forms and sign-in flows. Session cookies have no fixed expiry date; persistent cookies have an explicit lifetime.

2. Cookies Spendwell sets

These are first-party cookies set by Spendwell for authentication and security, not advertising or analytics:

bt_session

Keeps you signed in by linking your browser to your server-side session. It does not contain your financial records.

Duration: up to 7 days from sign-in. Signing out removes this browser’s session cookie and invalidates that session.

bt_csrf

Helps protect forms and other changes from cross-site request forgery. It is set when you visit the site, including public pages, so forms can work securely.

Duration: your browser session. Browser session-restore settings can preserve session cookies for longer.

bt_oauth_state

Helps verify that a Google sign-in callback matches a sign-in flow started in your browser.

Duration: up to 10 minutes. Normally cleared during a matching sign-in callback.

In the HTTPS production service these cookies use Secure, HttpOnly and SameSite=Lax protections. They are host-only cookies, not shared across all Spendwell subdomains. Signing out removes bt_session, but does not remove the security cookie bt_csrf.

3. Other browser storage

Spendwell uses sessionStorage with the key spendwell-position to restore your place after saving a transaction. It temporarily stores the return URL (including selected filters or month), scroll position and edited transaction’s identifier.

The value is read and removed when the next page’s script runs. Otherwise it remains for the tab’s browsing session, subject to your browser’s session-restore behaviour. Unlike a cookie, this value is not automatically sent with every request. Spendwell does not use localStorage for tracking or persistent preferences.

4. External services

The cookies listed above are set by Spendwell. When you visit Google to sign in, Google may set cookies on its own domains under its cookie policy.

Your browser also contacts UNPKG to load the interface’s htmx library and Google to load your profile image when available. Those providers receive normal request information and handle their services under their own policies. Spendwell does not use these requests as advertising or analytics tracking. The Privacy Policy’s provider section explains these external connections.

5. Your controls

You can review, block or delete cookies and site storage in your browser’s settings. Blocking necessary cookies will prevent sign-in or secure forms from working correctly. The public policy pages remain readable without signing in or enabling JavaScript.

No optional analytics or advertising storage is configured, so there is no optional-cookie consent control. If optional tracking is introduced, we will update this policy and provide any consent controls required before it is used. Reading this policy or signing in is not treated as consent to optional tracking.

6. Changes and contact

We will update this page when the storage we use changes. The date at the top identifies the latest revision.

Spendwell is operated by Guido Pili, an individual based in Italy. For questions about cookies, privacy or browser storage, email contact@spendwell.dev. For information about personal data beyond browser storage, see the Privacy Policy.