Legal
Cookie Policy
The cookies, browser preferences, setup drafts, and asset caches identified in AccountGo's website and app, with their purposes and storage lifetimes.
1 Website and app storage
This draft covers the reviewed implementation of accountgo.dev and the AccountGo web app/API. Rules can apply to technologies that store or access device information even when they are not HTTP cookies. The inventory below describes source-code behavior, not a claim that the site is already deployed or a complete inventory of provider-side technologies.
| Technology and scope | Purpose | Implemented lifetime or remaining check |
|---|---|---|
localStorage key accountgo-scheme |
Remembers the selected light or dark display theme in the browser. | No application-set expiry; remains until overwritten or browser/site data is cleared. |
App cookie accountgo_refresh_token |
Maintains sign-in and obtains fresh access tokens. HttpOnly, SameSite=Lax, path /api;
Secure is set when the API detects HTTPS. |
Seven days from issue/refresh, renewed on successful refresh. Logout/account closure clears this cookie and revokes the relevant refresh session(s). Expiry does not erase the server's session history. |
App local storage: accountgo:theme, accountgo:scheme,
accountgo:sidebar_mode, accountgo:lastOrgSlug,
accountgo:assistant-open
|
Remembers display theme, light/dark/system choice, sidebar mode, last workspace, and whether the assistant panel is open. | No application-set expiry; updated by choices or removed by browser/site-data clearing. The last-workspace key is also cleared by the account-closure UI. These preferences are not all automatically cleared at logout. |
App local storage: accountgo.createOrgDraft.v1 |
Saves unfinished workspace setup, including workspace/legal name, slug, currency, accounting-policy choices, and current step. | No application-set expiry. Cleared after successful workspace creation or when site data is cleared; an abandoned draft may remain on a shared device. |
App session storage: accountgo:invitationToken |
Keeps an invitation available while moving through sign-in and acceptance. | Tab/session-scoped storage; the acceptance flow removes the token. The server-side invitation expires after seven days independently of this browser value. |
Assistant SDK layout storage key accountgo:assistant-sidepanel-layout |
The app supplies this key to the third-party chat layout for panel sizing/layout preferences. | The SDK's storage mechanism, additional keys, and lifetime require a separate dependency review; they are not established by the app call site alone. |
| Website service worker/Workbox precache | Caches built public pages, scripts, styles, images, fonts, and the web app manifest for loading/update behavior. | Build-revision based rather than a fixed time-to-live; browser eviction, updates, or clearing site data can remove cached assets. No API runtime cache is configured in this website's Workbox setup. |
App service worker caches accountgo-v1-shell and accountgo-v1-assets
|
Caches the offline page, manifest, icons, and built assets. API and hub requests bypass this cache; app HTML navigation uses the network with an offline-page fallback. | No time-based expiry; asset cache is capped at 100 entries and activation removes other cache names. Browser eviction or clearing site data can also remove them. This is not an offline copy of accounting API records. |
| Google-hosted app fonts and browser HTTP cache | The app loads font styles/assets from fonts.googleapis.com and
fonts.gstatic.com, making requests to Google.
|
Provider response headers and browser rules determine HTTP caching. Provider-side storage/access and retention require confirmation; do not treat fonts as evidence of a Google Analytics integration. |
| Other provider cookies, tags, SDKs, and device storage/access | No first-party analytics/ad integration was identified in the reviewed website/app source. The app refresh cookie above is explicitly implemented. | Provider response headers, private deployment configuration, and chat SDK internals may add technologies not established by these first-party call sites. |
2 How we use these technologies
The identified purposes are maintaining sign-in, remembering selected interface/workspace settings, resuming invitations and unfinished workspace setup, displaying app fonts, and caching public/interface assets. Authentication access tokens are held in app memory rather than first-party local storage; the refresh token is held in the HttpOnly cookie. The app retrieves AI conversation history through its API, rather than treating panel-preference storage as the conversation database.
Server-side logs and traces are not browser cookies. The checked Cloudflare configuration enables persisted invocation logs and traces with a sampling rate of 1.0. See the Privacy Policy .
3 Consent and choices
The legal requirements for device storage and access depend on the technology, purpose, jurisdiction, and any applicable exception. For example, UK PECR and the EU ePrivacy framework regulate storage/access technologies, not only files technically called cookies.
The reviewed source provides a theme toggle and saves that preference to local storage. It does not show a cookie consent or preference-management interface.
You can clear cookies, local/session storage, and service-worker caches through your browser's site-data settings for each AccountGo origin. Clearing them can sign you out, reset preferences, remove an unfinished workspace draft, or interrupt an invitation. Blocking the refresh cookie can prevent persistent sign-in. Clearing browser data does not delete server records or AI history. This browser control is not a substitute for any legally required consent or opt-out mechanism.
4 Third parties and retention
The table distinguishes code-set durations from storage with no application-set expiry. These device lifetimes are separate from server-side data retention. Cloudflare provides the configured infrastructure; the app loads Google fonts and embeds Anter's chat SDK. Their contractual roles and any additional storage/access need confirmation. See Privacy Policy: recipients.
5 Changes and contact
We will update this policy if the technologies or purposes change.
General questions can be sent to support@accountgo.dev.
This draft is not legal advice and is not a statement that AccountGo currently complies with any particular law.