ReceiptTrack
Cookies Policy
How ReceiptTrack uses cookies, browser storage, analytics tags, and similar technologies on the marketing site and web app.
Last updated: 21 July 2026
ReceiptTrack Cookies Policy
This policy explains how ReceiptTrack and GRIMSOFT LTD use cookies, localStorage, sessionStorage, IndexedDB, analytics tags, and similar technologies across receipttrack.co.uk and the ReceiptTrack web app.
1. What this policy covers
UK cookie rules cover more than traditional cookies. They also apply when a website stores information on your device, or accesses information stored on your device, using technologies such as browser storage, pixels, scripts, and tags.
ReceiptTrack uses these technologies only where they support service delivery, account security, HMRC-related fraud-prevention requirements, user preferences, analytics, or future marketing measurement that you consent to.
2. Categories we use
| Category | Purpose | Consent |
|---|---|---|
| Essential and security | Sign-in, session continuity, authenticated requests, abuse prevention, HMRC fraud-prevention headers, rate-limit and security controls. | Always on because they are needed to provide and secure the service. |
| Preferences | Remember language, selected workspace, waitlist dismissed/subscribed state, report format choices, and practical UI settings. | Always on because they support requested app functionality and a consistent user experience. |
| Analytics | Google Analytics 4 page views and conversion events for marketing, signup, pricing, waitlist, and product journey improvement. | Off until you consent. You can withdraw consent from cookie settings. |
| Marketing | Reserved for future advertising measurement or retargeting. ReceiptTrack does not currently load Meta Pixel, TikTok Pixel, Hotjar, or Microsoft Clarity. | Off until you consent and until a matching technology is introduced. |
3. Current technologies
| Name or pattern | Technology | Use | Retention |
|---|---|---|---|
| Firebase Auth browser storage | IndexedDB / local browser storage | Keeps users signed in and protects authenticated dashboard access. | Managed by Firebase Auth and cleared on sign-out/account changes where applicable. |
| rt-encrypted-cache-v2:* | IndexedDB | Stores AES-256-GCM encrypted app and HMRC/VAT workspace cache envelopes to reduce flicker and repeated API requests. | Up to 24 hours, cleared on sign-out or user switch. |
| rt-encrypted-cache-owner-v2 | localStorage | Stores only an opaque derived key identifier to prevent one browser profile hydrating another user's encrypted cache. | Until sign-out, user switch, or manual browser clearing. |
| i18next language preference | localStorage / navigator language | Remembers or detects language preference. | Until changed or manually cleared. |
| receipttrack.postSignInPath | sessionStorage | Returns users to the requested app page after sign-in. | Current sign-in flow or browser session. |
| selectedAccount | localStorage | Remembers the workspace/account selected in the app. | Until changed, sign-out cleanup where applicable, or manually cleared. |
| waitlist_subscribed / waitlist_dismissed | localStorage | Prevents showing the waitlist prompt again after a user subscribes or dismisses it. | Until manually cleared or replaced by updated preference logic. |
| receipttrack.hmrc.deviceId / hmrc_device_id | localStorage | Supports HMRC fraud-prevention and audit headers for HMRC-related workflows. | Until manually cleared or regenerated by the HMRC workflow. |
| receipttrack.cookieConsent.v1 | localStorage | Stores your cookie/storage preferences. | 12 months. |
| Google Analytics 4 | Script/tag and analytics cookies/storage set by Google | Measures page views and conversion events after analytics consent. | Only after consent; retention is controlled by GA4 property settings. |
4. Google Analytics 4
GA4 is used only after analytics consent. We use it to understand marketing page performance, waitlist and signup interest, pricing journeys, and app/product navigation patterns. GA4 is not loaded before consent is saved.
If you reject analytics, ReceiptTrack still works. We may still use server-side security logs and operational telemetry where necessary to protect users and operate the service.
5. Managing your choices
You can accept all optional technologies, reject non-essential technologies, or manage analytics and marketing choices separately. Consent choices are stored for 12 months unless you clear browser storage or change settings earlier.