Cookie Policy

Necessary cookies

These cookies are necessary for you to sign in, to stay signed in, and for a connection to Dinero or e-conomic to be completed securely. They cannot be opted out of in our cookie settings. If you block them in your browser, you cannot use the service.

• sb-<project-ref>-auth-tokeninvoia (Supabase)

  Keeps you signed in and holds your session with Supabase, which provides our authentication. The <project-ref> part is a fixed identifier for our Supabase project. Where needed the cookie is split into numbered parts (.0, .1 and so on) because the contents can be too large for a single cookie. It is persistent, not a session cookie.

  Lifetime

  400 days

  Type

  First-party cookie

• sb-<project-ref>-auth-token-code-verifierinvoia (Supabase)

  Temporary PKCE verifier used during sign-in with Google or Microsoft. It ties the response from the sign-in provider to the browser that started the sign-in, so a response cannot be injected from another browser.

  Lifetime

  Short-lived — used and removed when the sign-in flow completes

  Type

  First-party cookie

• oauth_registrationinvoia

  Marks that a sign-in with Google or Microsoft was started as the creation of a new account rather than an ordinary sign-in, so that you are routed into the right flow afterwards.

  Lifetime

  5 minutes

  Type

  First-party cookie

• invitation_tokeninvoia

  Carries an invitation through the sign-up flow. Holds the invitation token, the invitee's email address and the name of the inviting account. Deleted once sign-up is complete.

  Lifetime

  1 hour

  Type

  First-party cookie

• onboarding_in_progressinvoia

  Remembers that you are in the middle of setup while you are sent to Dinero or e-conomic and back again, so that you land in the right place in the flow.

  Lifetime

  30 minutes

  Type

  First-party cookie

• dinero_connect_nonceinvoia

  One-time value ensuring that the response from Dinero belongs to the connection you started yourself. Protects against someone else initiating a connection on your behalf.

  Lifetime

  10 minutes

  Type

  First-party cookie

• dinero_reauth_integration_idinvoia

  Remembers which existing Dinero connection is being re-authorised while you are at Dinero.

  Lifetime

  10 minutes

  Type

  First-party cookie

• economic_connect_nonceinvoia

  One-time value ensuring that the response from e-conomic belongs to the connection you started yourself.

  Lifetime

  10 minutes

  Type

  First-party cookie

• cookietestinvoia (FingerprintJS)

  Written and immediately expired as a test of whether cookies are enabled in your browser. Set only on /sign-in and /register as part of the device check.

  Lifetime

  Expired immediately

  Type

  First-party cookie

• invoia-cookie-consentinvoia

  Stores your cookie preference for the three categories so that the banner is not shown again. It sits in browser storage on your own device and is not sent to us.

  Lifetime

  No expiry — browser storage does not expire on its own

  Type

  Browser storage (localStorage)

Functional cookies

These cookies remember a choice you have made so that you do not have to make it again. They are not necessary for the service to work.

• NEXT_LOCALEinvoia

  Remembers the language you selected in the language switcher, so that pages are shown in the same language next time.

  Lifetime

  1 year

  Type

  First-party cookie

Statistics

We measure which pages are visited in order to understand what is being used. That measurement currently runs on every page and is not conditioned on your cookie preference.

• Vercel Web AnalyticsVercel

  Measures page views on every page — both the public pages and the pages you see once signed in. The measurement script is loaded from our own domain and the measurements are sent to our own domain. We have checked in the browser on invoia.io that the measurement neither sets cookies nor writes to browser storage, and that no request is sent to a third-party domain. Vercel receives the address visited and your IP address; the latter happens in any event, because Vercel is our hosting provider and therefore receives all traffic.

  Lifetime

  Sets no cookie

  Type

  First-party script

Third-party scripts on individual pages

On individual pages we load a script from another provider, or a library in our own code sends a request to the provider's domain. We do not control what those providers store on your device. Your IP address and browser identification are necessarily visible to them when the request is made.

• js.stripe.comStripe

  Loaded on the payment step during sign-up and on the payment card panels under Billing. Stripe carries out the card payment and guards against misuse. Card details are entered directly into Stripe's own field and never reach our servers. On our own domain we have observed the cookie __stripe_mid, which Stripe uses to recognise the device in its misuse checks. Stripe may set further cookies under its own cookie policy; __stripe_sid was not present at the time of measurement, and we have not verified it.

  Lifetime

  Determined by Stripe

  Type

  Third-party script

• m1.openfpcdn.ioFingerprintJS

  The library that computes the device identifier on /sign-in and /register sends an anonymous usage request to the vendor's own domain on roughly one in a thousand loads. The request contains neither the device identifier nor any of the characteristics read, but FingerprintJS sees your IP address and your browser identification when it is sent.

  Lifetime

  Sets no cookie

  Type

  Third-party request

Marketing

We use no marketing, advertising or retargeting cookies. There are no cookies in this category, and we share no information with advertising networks.

We use no cookies in this category.