Cookies Policy

These cookies are required for the Service to work. You cannot disable them without breaking sign-in or basic page rendering.

• fb_session — httpOnly session cookie, set after a successful sign-in via Firebase Authentication. Lifetime: 7 days. Without this cookie you are signed out.
• anon_session — httpOnly, signed, issued the first time you use a "try it now" tool without an account. Lifetime: 30 days. Lets us apply the free-try limit without requiring sign-up.
• wishlist_session — httpOnly, issued when you open or claim an item on a shared wishlist. Lifetime: 90 days. Remembers which items you already claimed.
• CF_AppSession, CF_Authorization — set by Cloudflare on staging environments only, used for access control. Not present on the production site.

These store your preferences across visits. They never leave your browser; nothing is sent to us.

• theme — remembers light/dark/system preference. Stored in localStorage.
• language — remembers your interface language when set explicitly. Stored in localStorage.
• Wizard / split-bill drafts — drafts of bills you are still editing, persisted to localStorage so a refresh does not lose work. Cleared when the bill is saved or discarded.
• uiVersion, app_v2 — remember whether your account uses the current or the newer app layout. Not httpOnly (read by the page to route you correctly); not a secret. Lifetime: 7 days, refreshed on sign-in.
• active_workspace — remembers which workspace you were last viewing, if you use more than one. Not httpOnly; every request is still re-checked against your real membership server-side, so this cookie cannot grant access on its own. Lifetime: 7 days, refreshed regularly while signed in.

We use Google Analytics 4 to understand how the app is used (which pages are visited, broad device/region breakdowns) so we can improve it. These cookies are off by default and are only set after you enable the Analytics category in our cookie banner. If you do not consent, Google Analytics is never loaded and none of the cookies below are set.

• _ga — distinguishes visitors. Lifetime: up to 2 years. Set by Google Analytics.
• _ga_<container-id> — persists session state for a specific GA property. Lifetime: up to 2 years.
• Turning this category on also stores, on our own server (not a cookie): a coarse country from your network location, a coarse device type (mobile/tablet/desktop), and the Google Analytics identifiers needed to link a payment to your session. Never your exact location, IP address, or a device fingerprint. See our Privacy Policy §2 and §6.
• You can withdraw consent at any time by reopening the cookie settings and turning Analytics off; the cookies stop being set, the server-side fields above are deleted immediately, and you can clear existing cookies from your browser.
• Separately, whichever choice you make in this banner increments an anonymous daily counter (e.g. "accepted", "rejected") with no cookie, IP address, or other identifier attached — this is aggregate statistics, not personal data, so it is not itself a use that requires consent.

We integrate two third parties whose cookies you may encounter:

• Firebase Authentication (Google) — sets cookies on accounts.google.com during the sign-in popup. These are subject to Google's cookie policy.
• Our payment provider (Merchant of Record for paid plans) — sets cookies on its checkout domains during the upgrade overlay only. Required for the checkout flow to render and complete. See the cookies policy linked from the checkout window.

• No advertising cookies.
• No cross-site tracking cookies.
• No third-party analytics without consent. Google Analytics (§3.3) is the only analytics tool and it stays off until you opt in.
• No social-media share-button cookies.