Legal Cookie Policy
Cookie Policy
This page explains the cookies and similar storage technologies we use on codasc.dev, what each is for, and how you can control them.
1. What cookies and local storage are
Cookies are small text files a website stores in your browser. We also use local storage, a similar browser feature for remembering small preferences. Some of these are essential to make the site work; others help us understand usage. We group them below.
2. What we use
| Name | Type | Purpose | Category |
|---|---|---|---|
| Session token | Cookie | Keeps you signed in to your account. Without it you cannot log in. | Strictly necessary |
| Sign-in state | Cookie | Short-lived values used during the sign-in / sign-up flow to keep it secure. | Strictly necessary |
codasc-theme | Local storage | Remembers your light / dark theme choice. | Functional |
codasc-cookie-notice | Local storage | Remembers that you have dismissed the cookie notice so it isn’t shown again. | Functional |
codasc-seen, codasc-seen-* | Local storage | Remembers the date we last recorded your visit, so we record it once a day instead of on every page load. | Functional |
bir-dat:workspace | Local storage | Holds your entire BIR DAT working file — taxpayer profile and employee rows — on your own device. This is deliberate: it is how your tax data stays off our servers. Clearing it deletes that work permanently unless you have a backup. | Strictly necessary |
| App preferences | Local storage | Each app remembers small local settings (such as your last-used view or a dismissed hint) so it behaves consistently between visits. | Functional |
_ga, _ga_* | Cookie | Google Analytics — measures how the Codasc website and app suite are used, including which pages you visit and actions such as signing up or opening an app. Receives your IP address, browser user-agent and the pages you visit. | Analytics |
_fbp, _fbc | Cookie | Meta (Facebook) pixel — set only on the Studio Services pages at app.codasc.dev/studio, where our advertising links land. They record that a visit or an enquiry followed one of our ads. Meta receives your IP address, user-agent, the page address, and — if you send the form — your email and mobile number in hashed (scrambled) form, which the form tells you before you agree. They are not set anywhere else on Codasc. | Marketing |
codasc_auth_evt | Cookie | Set for one minute after you sign in with Google, purely so the site can record that the sign-in happened in its usage analytics. Holds no personal data and is deleted as soon as it is read. | Analytics |
Separately from cookies, the apps load their typefaces from Google Fonts. Your browser fetches these directly from Google, which discloses your IP address and user-agent to Google on each visit. No cookie is set by this.
3. Strictly necessary cookies
The session and sign-in cookies are required to operate the Service and keep your account secure. They are exempt from consent because the site cannot function without them. Blocking them will prevent you from logging in.
4. Analytics cookies
We use Google Analytics across the Codasc website and the signed-in app suite to understand which pages are visited and how people move through them — including milestones such as creating an account, opening an app or starting a checkout — so we can improve them. We do not use it to identify you personally and we do not sell your data. It does, however, receive your IP address and user-agent, so it is not anonymous.
Please be aware: our cookie banner is currently a notice, not a consent gate — analytics load when the page loads, and dismissing the banner does not change that. We are working on proper consent controls. In the meantime the reliable way to opt out is at the browser level, using the options in Section 6.
5. Advertising measurement
On the Studio Services pages only (app.codasc.dev/studio), we use the Meta pixeltogether with Meta’s Conversions API to see which of our Facebook and Instagram ads lead to an enquiry. Our server sends Meta the same event the pixel does, so blocking the pixel alone does not stop it; what the server sends is the page address, your IP address and user-agent, and — only when you submit the form, and only after you tick the consent box — your email and mobile number hashed with SHA-256, which Meta uses to match the enquiry to an account. It also carries which kind of work you asked about and the starting figure of the budget range you picked, so we can tell which ads bring the enquiries worth having. We never send your name or anything you wrote. None of this runs on the rest of Codasc.
6. How to control cookies
- Browser settings — every major browser lets you block or delete cookies and clear local storage. Doing so for strictly-necessary cookies will stop you logging in; clearing local storage will delete unsaved BIR DAT work.
- Opt out of Google Analytics — install Google’s opt-out browser add-on, or block analytics cookies and scripts in your browser. This works regardless of our banner.
- Ask us — email [email protected] and we will action any opt-out or data request for your account by hand.
7. More information
For how cookie data fits into the wider picture of what we collect and your rights, see our Privacy Policy.
Questions about this document? Email [email protected].