DRAFT — not ready to publish
This document describes how the app really works, but the controller's details and a professional review are still missing. Parts in square brackets must be completed or checked.
Missing details: controller, legal form, address, privacy email, domain, governing law, competent court, retention after deletion, effective date.
Cookie Policy
Text last revised: 2026-10-18
This page lists the cookies and other tools WeBudget stores on or reads from your device, taken from the app's code. Where a detail depends on an external provider we mark it as "to check".
What they are
Cookies are small files a website stores in your browser. Similar tools include the browser's local storage (localStorage, sessionStorage, IndexedDB), the service worker cache and third-party scripts. The law treats them alike: necessary technical tools need no consent, the others do (Art. 122 of the Italian Privacy Code, Italian DPA cookie guidelines of 10 June 2021).
Categories
Necessary: needed to sign in, keep your account secure, remember your language, the preferences you choose and your cookie choice. Always on.
Advertising: Google AdSense banners for people using the app for free. They stay off until you turn them on; without consent Google's script is not even downloaded.
We use no statistics (analytics) or profiling tools of our own: that's why there are no other categories.
Advertising is not active today (Google AdSense is not configured): the site uses only necessary technical tools and no banner is shown.
| Name | Purpose and when it starts | Provider | Category | Duration |
|---|---|---|---|---|
NEXT_LOCALEcookie · first-party | Remembers your language (Italian or English). Set on your first visit. | WeBudget (next-intl) | Necessary | until you close the browser |
wb_consent_v1cookie · first-party | Remembers your cookie choice, with a random ID for that choice. Set when you choose in the banner.not active now | WeBudget (Consenti) | Necessary | 180 days |
authjs.session-token, __Secure-authjs.session-tokencookie · first-party | Keeps you securely signed in (encrypted session, not readable by scripts). Renewed while you use the app. | WeBudget (Auth.js) | Necessary | 30 days |
authjs.csrf-token, __Host-authjs.csrf-token, authjs.callback-url, __Secure-authjs.callback-urlcookie · first-party | Protects sign-in forms against forged requests and remembers where to return after signing in. | WeBudget (Auth.js) | Necessary | until you close the browser |
authjs.pkce.code_verifier, authjs.state, authjs.noncecookie · first-party | Only while signing in with Google or Facebook: checks the provider's answer is the expected one. | WeBudget (Auth.js) | Necessary | 15 minutes |
wb-devicecookie · first-party | Recognises a device you've used before, so we can email you when someone signs in from a new one. Set on first sign-in. | WeBudget | Necessary | 400 days |
wb-theme, wb-group-closed-*, wb-proposal-dismissed-*, wb-rebalance-dismissed-*, wb-donate-hidden-untillocal storage · first-party | Preferences you choose: light or dark theme, groups collapsed on Home, suggestions you've hidden, donation reminder hidden. | WeBudget | Necessary | until you remove it (or clear the cache) |
wb-lock, wb-unlocked, wb-hidden-atlocal storage · first-party | Only if you turn on the Face ID or fingerprint lock: remembers which device key to use and whether the app is unlocked in this session. | WeBudget | Necessary | until you remove it (or clear the cache) |
wb-*service worker cache · first-party | The "you're offline" page and the installable app icon. None of your data is stored here. | WeBudget | Necessary | until you remove it (or clear the cache) |
keyval-storeIndexedDB · first-party | Only if you read a photo or scan: the text-recognition engine and languages, so they aren't downloaded again. None of your data. | WeBudget (Tesseract.js) | Necessary | until you remove it (or clear the cache)to check |
PushSubscriptionscript / browser service · first-party | Only if you turn on notifications: the subscription managed by your browser to receive them. | WeBudget | Necessary | until you remove it (or clear the cache) |
challenges.cloudflare.comscript / browser service · third-party | Only if enabled: Cloudflare's anti-spam check on the sign-up, sign-in, password-reset and support forms. | Cloudflare, Inc. | Necessary | set by the provider, to checkto check |
__gads, __gpi, __eoi; google.com, doubleclick.netcookie · third-party | Only if enabled and only with your consent: shows and measures Google AdSense ads at the bottom of Home and Activity.not active now | Google Ireland Ltd. (Google AdSense) | Advertising | set by the provider, to checkto check |
How to choose, change or withdraw consent
On your first visit the banner offers "Accept all", "Reject all" and "Customise", with equal weight. You can change your mind at any time from "Cookie preferences" at the bottom of every page and in the app's Settings: withdrawing consent stops advertising and reloads the page without Google's script. Your choice lasts 6 months, then we ask again; we ask sooner only if purposes or providers change.
You can also delete cookies in your browser settings and turn on the Global Privacy Control signal, which we honour by switching advertising off.
The banner uses Consenti, free software (Apache 2.0 licence) that runs in your browser without sending data to third parties. Each choice is also recorded on our server, without the IP, so we can demonstrate it.
More information
To learn how we process personal data, read the Privacy policy. Controller: [TO COMPLETE: name or company name of the controller], [TO COMPLETE: email for privacy requests].