Cookie Policy
Cookies and browser storage
Last updated: October 6, 2026
Essential authentication cookies
Supabase authentication uses first-party session cookies so signed-in users can access their accounts. OAuth also uses a short-lived, HttpOnly CAPTCHA proof cookie for its callback. These are necessary for authentication and abuse prevention and cannot be disabled while using sign-in features.
Browser preferences
CCAO stores your selected light or dark theme and your analytics choice in browser local storage. These are browser storage entries, not cookies. They remember your preferences and are not used for advertising.
Optional analytics
Vercel Analytics is disabled until you allow optional analytics. Google Analytics 4 may also load after you allow it, but only when the site operator has configured it. Analytics providers may process usage and technical information under their own policies. Rejecting optional analytics does not affect sign-in or core app features.
CAPTCHA verification
Sign-in uses Cloudflare Turnstile to limit automated abuse. Challenge tokens are verified by Cloudflare, and a short-lived proof is used to complete OAuth callbacks. Email magic-link tokens are validated by the configured Supabase Auth CAPTCHA integration. Cloudflare and Supabase may process technical request information under their own policies.
Change your choice
Use in the footer to allow or reject optional analytics at any time. You can also clear CCAO site data in your browser settings. Clearing it removes the saved theme and consent choice; the choice prompt will appear again.
Self-hosted deployments
If you run your own CCAO deployment, its operator controls which analytics integrations are configured and is responsible for updating this policy and honoring applicable requirements.
For information about account and budget data, see the Privacy Policy.