TrackIt Life — Cookie and Device Storage Policy
Version 1.13 — 13 October 2026
This policy lists everything TrackIt Life stores on your device — cookies, local storage, session storage and IndexedDB — what each item is for, how long it lasts, and whether it is strictly necessary. It covers the TrackIt Life apps and, in section 9, our website at trackitlife.app. It is kept in step with the cookie banner and with the machine-readable register at /api/consent/config; if you find a discrepancy, tell us at privacy@trackitlife.app.
1. The short version
- We set no third-party cookies and load no third-party scripts or resources. Everything on our pages is served from domains we run ourselves, including the optional analytics described below.
- In the apps, the only optional storage is for analytics, which uses a copy of the open-source tool Umami running on our own server. It is off by default and is only loaded if you accept it in the cookie banner.
- Everything else in the apps is strictly necessary to sign you in, keep you signed in, keep the household's financial figures encrypted, and remember your consent choice. You cannot switch these off. Signing out clears what the apps keep in your browser — section 4 explains exactly when.
- Our website sets no cookies at all (section 9).
Some of the items below are not cookies but local storage (kept until it is cleared), session storage (cleared when the tab closes) or IndexedDB (kept until it is deleted; section 5 says when). The law on consent (PECR regulation 6) applies to all of them the same way, so we list them all.
2. Managing your choices
The cookie banner belongs to the account area — the sign-in and account pages that every app shares — and appears on your first visit there. You can reopen it at any time from the Cookies link in the footer, which opens this policy and carries an Open Cookie Settings button, or from Privacy Center → Cookie Settings. Your choices are kept in the klaro-consent local-storage key and the trackit_analytics_consent cookie listed below.
The banner has two categories:
| Category | What it covers | Default | Can you switch it off? |
|---|---|---|---|
| Essential | The cookies in section 3 and the storage in sections 4 and 5 | Always on | No — they are strictly necessary |
| Analytics | Umami, section 6 | Off | Yes, at any time |
Until 24 September 2026 the banner also offered a Preferences category. No cookie or storage item ever belonged to it, so it has been removed. If we ever add preference storage, it will be listed here and will appear in the banner as a new category, off until you turn it on.
Declining analytics has no effect on any feature.
3. Cookies
The session cookies our servers set — sid, refresh, device and admin_token — carry HttpOnly (not readable by page scripts) and Secure (sent over HTTPS only). They are scoped to the parent domain of our apps, set by configuration, which is what lets one sign-in work across the apps.
| Cookie | Purpose | Lifetime | Strictly necessary? |
|---|---|---|---|
sid | Your access token — proves you are signed in on each request | 15 minutes, renewed from the refresh token | Yes |
refresh | Your refresh token — used to issue a new access token. Rotates on every use; a replayed old token ends the whole session | 30 days | Yes |
device | A random identifier for this browser, stored against your sign-in session so we can tell your sessions apart. It holds no information about you or your device | 365 days | Yes |
admin_token | Staff-only session cookie. Set only when one of our operators signs in to the admin system; never set for ordinary users | 12 hours | Yes (staff only) |
requireUnlock | Tells the app you have just opened that it should ask for your vault passphrase | 1 hour | Yes |
idle_flag | Mirrors your activity across open tabs so that the idle sign-out timer is shared between them. Contains no data | About 50 milliseconds; cleared immediately | Yes |
tl_logout | Tells every open TrackIt tab that you have signed out. Contains a timestamp only | 90 seconds | Yes |
trackit_analytics_consent | Records whether you accepted or declined analytics. The analytics script is loaded only if this cookie's value is exactly 1 | 365 days | Yes — it is the record of your choice, including a choice to decline, so it is set either way |
We do not set a CSRF token cookie. Protection against cross-site request forgery is provided by the cookies' SameSite attributes and by an origin check on every state-changing request.
4. Local storage
Local storage is kept until it is cleared. Everything here is strictly necessary or remembers a setting you chose.
When it is cleared. Only the account area and the Finance app keep anything in local storage; the Fitness, Shopping and Diet apps keep nothing there of their own. Signing out of the account area or the Finance app clears that app's local and session storage. When you sign out anywhere, an open Finance tab hears the sign-out and clears its storage too; if the Finance app is not open at the time, it clears its storage the next time you open it and it finds your session has ended. Clearing this site's data in your browser always removes everything. Locking the Finance vault on its own does not clear local storage — on a shared or borrowed device, sign out, or clear the site's data, when you finish.
| Key | Where | What it holds | Lifetime |
|---|---|---|---|
klaro-consent | Account area | Your cookie-consent choices | Until you change them, sign out, or clear browser data |
shell:faceIdPrompt:dismissedUntil | Account area (written only inside our iOS app) | "Not now" on the iOS app's Face ID sign-in offer — a date 30 days ahead, nothing else | Until that date passes, sign-out, or cleared |
fitness:healthConnectCard:dismissedUntil | Fitness app (written only inside our iOS app) | "Not now" on the Fitness dashboard's Connect Apple Health card — a date 30 days ahead, nothing else, no health data | Until that date passes, or cleared |
e2e:paillier:pk | Finance app | Your Paillier public key (cached). Used to encrypt amounts before they leave your browser. Not secret | Until sign-out or cleared |
e2e:paillier:sk | Finance app (legacy) | Not written by the current version. Earlier versions could store an unwrapped copy of your Paillier private key here, so it may still be present on a device that used one. Today the private key is held unwrapped only in session storage (e2e:vault:session:sk, section 5), for the open tab and only while the vault is unlocked; at rest it is kept only wrapped with your passphrase (e2e:vault:ciphertext, below). Signing out removes any old copy; if you used TrackIt on a shared or borrowed device before 24 September 2026 and did not sign out there, clear this site's data on it. Corrected 24 September 2026: earlier versions of this policy said this key was written when your keys were set up or a vault backup was restored | Until sign-out or cleared |
e2e:vault:ciphertext | Finance app | Your private key wrapped (encrypted) with your vault passphrase, so the vault survives a page reload. Cannot be used without your passphrase | Until sign-out or cleared |
e2e:autoLockMinutes | Finance app | How many minutes of inactivity before the vault locks itself — a cached copy of the preference held on your account | Until sign-out or cleared |
auth:autoLogoutMinutes | Finance app | How many minutes of inactivity before you are signed out | Until sign-out or cleared |
currency, dashboard-active-view, dashboard-view-mode, dashboard-card-standins, income-sources-nudge, import:showAllColumns | Finance app | Interface settings: your chosen currency, the dashboard view you last used, whether the dashboard's Spending view and your budgets include card purchases not yet on an imported statement (0 when you have unticked it; no figures), whether you have already seen the dashboard's one-time note about income sources we found (1 once you have reviewed or closed it; no figures, no payer names), and whether the statement import's review shows every column | Until sign-out or cleared |
fin:prefill:categories, fin:lifestyle:draft:v1 | Finance app | Category names and draft answers while you set up your financial profile | Until sign-out or cleared |
import:selfHolderName | Finance app (legacy) | Legacy: nothing writes it now. Until 26 September 2026 the Import page kept the account holder name you typed there, in both local and session storage; your own names now live on your Finance profile (Privacy Policy 5.1). The Import page deletes both copies the next time it opens, and signing out removes them | Until the Import page next opens, sign-out, or cleared |
currentUser | Finance / Fitness apps (legacy) | Nothing writes this key now. Earlier versions stored a user object here, including a sign-in token, so it may still be present on devices that used an older version. The apps ignore it and the Fitness app removes it on start | Until removed |
paillier:sk, E2E_PRIVATE, paillier:pk, E2E_PUBLIC | Finance app (legacy) | Older names for the two key entries above. Nothing writes them now. The app still reads the two public-key names, so they may persist on a device that used an earlier version; the two private-key names should be treated exactly like e2e:paillier:sk | Until sign-out or cleared |
debugVaultApi | Finance app | Developer diagnostic flag; not set in normal use | Until cleared |
5. Session storage and IndexedDB
Session storage is cleared when you close the tab, and when you sign out of the app that wrote it. Everything here is strictly necessary.
| Key | Where | What it holds | Lifetime |
|---|---|---|---|
auth_checked | Account area | Marks that this tab has verified your sign-in. Holds no personal data | Life of the tab |
shell:faceIdPrompt:autoSignIn | Account area (written only inside our iOS app) | A one-shot marker (the literal 1, nothing else) that the app signed you out automatically — the idle timeout, or a session that expired — so the sign-in screen can offer Face ID straight away. Signing out yourself never writes it | Until the sign-in screen reads it (it is cleared on read), or the tab closes |
e2e:vault:session:sk | Finance app | Your decrypted Paillier private key, while the vault is unlocked. This is what lets the Finance app show you your amounts. Written when you unlock the vault; removed when the vault locks (automatically after your chosen auto-lock period, or when you lock it), when you sign out, and when the tab closes | Until the vault locks, sign-out, or the tab closes |
e2e:unlocked, e2e:sessionKey | Finance app | Legacy markers (1) that the vault is unlocked. Removed with the key above | As above |
e2e:requireUnlockGate, requireUnlockGate | Finance app | Whether this tab has already asked for your vault passphrase | Life of the tab |
reports-totals-v1 | Finance app | Decrypted totals from the Insights, Income and Custom reports — the figures a report shows, so a reload or a return to the tab does not decrypt the year again. Figures only: no encrypted amounts and no raw transaction data. Written only while the vault is unlocked, and removed when the vault locks — automatically or by you — when you sign out, and when the tab closes | Until the vault locks, sign-out, or the tab closes |
quickreport-session | Finance app | Decrypted totals from the Expenses report (per category, bank, account and tag). Written only while the vault is unlocked, and removed when the vault locks, when you sign out, and when the tab closes. Until 27 September 2026 the Finance app also kept decrypted report figures under customreport-rows-v1, customreport-native-v1, creditCardTotal and income-reports-session-v5; nothing writes them now, and any left in your browser are deleted the next time the vault locks or you sign out. Until 24 September 2026 the Income report also kept a copy of its figures in a 3-day cookie, income-reports-cookie-v5; nothing sets it now, and any left in your browser is deleted the same way | Until the vault locks, sign-out, or the tab closes |
income-reports-tab, income-reports-source-filter | Finance app | The Income report's last-open tab, and which of your income sources you have switched on or off — the second holds your income source names. Written only while the vault is unlocked, and removed when the vault locks, when you sign out, and when the tab closes. Until 24 September 2026 these were 3-day cookies; any left in your browser are deleted the next time the vault locks or you sign out | Until the vault locks, sign-out, or the tab closes |
quickreport-template, quickreport-filterout, quickreport-filterin, quickreport-filtermode, quickreport-groups | Finance app | The layout and filters of a quick report | Life of the tab |
import:basket:tab | Finance app | A random id for this tab that ties your unfinished statement import (below) to it. Until 26 September 2026 the Finance app also kept import:draft:v3, import:statementMeta, import:statementMeta:paymentsHandled, currentImportId and a session copy of import:selfHolderName (section 4) here; nothing writes them now, and any left in your browser are deleted the next time the Import page opens | Life of the tab |
expenses-tab, reports-tab, financialProfileSubmitted, fin:profileCreated:<accountId>, finprof:currentStep, skipLifestyleOnce, trackit.myBanks.panels | Finance app | Screen state: last-open tabs, profile-setup progress, which bank panels you opened or closed on My Banks. fin:profileCreated includes your household's account id; trackit.myBanks.panels holds internal bank ids only, no names or figures | Life of the tab |
IndexedDB. Two items: the Finance app's unfinished import, and the iOS app's read cache. Unlike session storage neither is cleared when the tab closes, so each lifetime is stated in full. Both are strictly necessary: the first keeps an import you started from being lost if the page reloads; the second shows a screen you have already opened without waiting for the network, and is only ever written inside the app.
| Key | Where | What it holds | Lifetime |
|---|---|---|---|
import:basket:v1 (database trackit-import) | Finance app | Your unfinished statement import: the transactions read from the statements you added (description, date, amount, category and tags, and the bank and account each statement is for), each statement's file name and upload reference, a credit-card statement's summary figures (balances, payments and charges, and — where the statement prints them — the credit limit, minimum payment and interest rate; never the card's digits), per month the budget it imports into and its income list, and your keep/skip choices on possible duplicates. It does not hold the statement files themselves, or any amount decrypted from your existing records | Deleted when the import finishes or you clear it, when the vault locks, and when you sign out. It belongs to the tab that made it: a reload of that tab restores it, but closing the tab does not delete it at once — it is deleted, unread, the next time the Import page opens in any tab. If neither happens, it stays on this device until you clear this site's data |
trackit-cache (database trackit-cache) | Fitness, Shopping and Diet apps, and the account area — in the iOS app only | In the iOS app only: the last copy of screens you have opened in the Fitness, Shopping and Diet apps and the account area, so they show at once and then update — today the Fitness dashboard, history, workouts and weight, Shopping's grocery reminders, Diet's plans and recipes, and the account area's setup checklist and badge counts. In Fitness it also keeps what a strength session starts from — your saved workouts, today's plan, the exercise list and what you lifted last time — so that a session can start in a gym with no signal; those copies are used only when the network does not answer. Each copy carries the time it was fetched and the id of the person signed in. Fitness copies include your workouts, weight and activity. It never holds anything from the Finance app or the vault, or anything about sign-in, consent or terms, and nothing is written in a browser | Deleted when you sign out (however you sign out, and when another tab or app announces it) and when someone else signs in on the device. A copy older than 7 days is never shown. Otherwise kept until the app's data is cleared |
6. Analytics (optional) — Umami in the apps
If you accept analytics in the banner, the account area and the Finance, Fitness and Shopping apps load Umami from our own analytics address, which is set by configuration — there is no third-party host. Each app checks the trackit_analytics_consent cookie first and loads nothing unless it records your acceptance. The Diet app loads no analytics at all. It runs on our own server; no data goes to any third party. It records page views and basic browser and device information so we can see which features are used.
Anything Umami stores on your device is covered by your analytics choice: the banner treats every item whose name begins umami. as belonging to this category, so withdrawing consent withdraws it for all of them.
If you decline, or never answer the banner, the script is never loaded and nothing analytics-related is stored, apart from the record of your choice (trackit_analytics_consent, section 3).
7. Cookies we do not set
You may see references elsewhere to session, auth_token, csrf_token, umami.uuid, theme, locale, sidebar_collapsed or trackitlife_privacy_acknowledged. Nothing in the current TrackIt Life apps or website sets these; they are listed here only so that this policy is complete.
8. Legal basis
| Category | Basis |
|---|---|
| Essential cookies and storage (sections 3, 4 and 5) | Strictly necessary to provide the service you asked for, so no consent is needed (PECR regulation 6(4)). Any personal data they hold is processed to perform our agreement with you (UK GDPR Art. 6(1)(b)) |
| Analytics in the apps (section 6) | Your consent (PECR regulation 6; UK GDPR Art. 6(1)(a)). Off until you accept it; you can withdraw it at any time from the banner or Privacy Center, and withdrawing stops it straight away |
| The website's analytics (section 9) | Our legitimate interest in understanding how the website is used (UK GDPR Art. 6(1)(f)). It stores nothing on your device, so PECR consent does not apply; you can opt out at any time |
9. The website (trackitlife.app)
Our website is separate from the apps and works differently:
- It sets no cookies.
- It uses Umami analytics, run on our own server and cookieless: it stores nothing on your device to count a visit. It does not record query strings or the part of an address after a
#, and if your browser sends a Do Not Track signal it records nothing at all. The basis is our legitimate interest (section 8), so the website shows no cookie banner. - The only thing the website ever stores on your device is the local-storage key
umami.disabled, and only if you opt out of analytics on the website's Cookies page. It holds no personal data; while it is set, Umami records nothing. It stays until you opt back in or clear the website's data in your browser. - Fonts and icons are served from the website itself; it loads nothing from a third-party origin.
10. Changes
We update this policy whenever we add, remove or change anything stored on your device. The version number and date at the top tell you which version you are reading.
11. Contact
A&C Digital Ltd, trading as TrackIt Life — privacy@trackitlife.app
Registered in England and Wales, company number 17064862.
Your analytics choice on this website
This sets or clears the umami.disabled key described in section 9.
Analytics on this browser: checking…