Cookies and local storage
Last updated 23 July 2026
Most sites open with a consent banner. This one does not, and the reason is simple enough to check: Invoice Forever sets nothing that requires consent. Below is every cookie and every browser-storage key the site uses. Not a summary. The whole list.
The complete list
| Name | Type | What it does | How long it lasts |
|---|---|---|---|
better-auth.session_token | Cookie | Keeps you signed in. Set only after you sign in, and it is the one thing that makes an account possible at all. | Until you sign out or it expires |
invoiceforever_guest_v1 | Local storage | The invoice you are building in the free generator before you have an account. It stays in your browser so a refresh does not throw your work away, and it is never sent to us. | Until you clear it or import it into an account |
invoiceforever_guest_import_dismissed | Local storage | Remembers that you closed the prompt offering to import a guest invoice, so it stops asking. | Until you clear your browser data |
if.support-note.dismissed | Local storage | Remembers that you closed the donation note on your dashboard. | Until you clear your browser data |
That is all of it. Three of the four are only created once you are actually using the thing they support, and none of them exists to track you.
Why there is no banner
Consent is required for storage that is not necessary to deliver what you asked for. Everything in that table is necessary: a session cookie so you stay signed in, a draft so your unsaved invoice survives a refresh, and two flags so a notice you closed stays closed. Under the ePrivacy rules that is the strictly necessary category, which is exempt. Asking you to approve it would be a piece of theatre, and refusing would just break the site.
The part most sites need a banner for is analytics, and we sidestepped it by building the analytics differently.
Analytics without cookies
We use PostHog on their EU cloud to count page views and catch errors and slow pages. It is configured to keep its state in memory only, which means it writes nothing to your browser: no cookie, no local storage, no identifier that survives the page. Close the tab and there is nothing left behind to recognise you by. Session recording and automatic click tracking are switched off, and no advertising network is involved anywhere on this site.
The trade-off is real and worth stating: we genuinely cannot tell whether two visits came from the same person. We decided that not following you around is worth more than a cleaner returning-visitor chart.
Third-party requests
There are none on the marketing site. No tag manager, no advertising pixel, no chat widget, no embedded video, no social buttons. Fonts are compiled into the site at build time rather than fetched from Google, so loading a page does not tell any other company that you were here.
You can verify all of this yourself in about a minute. Open your browser's developer tools, load any page on this site, and look at the Network tab and at Application → Storage. It should be empty until you sign in or start an invoice. If you ever find something there that is not in the table above, please tell us — that would be a bug.
Clearing any of it
Signing out removes the session cookie. Clearing site data in your browser removes everything else, including any unsaved guest invoice, so export or save anything you still want first.
Related
For what happens to the data you deliberately give us, read the privacy policy. For where it is stored and who can reach it, see security and the list of subprocessors.