Cookie Policy

The cookies and browser storage Handy uses, what each one is for, and how long it lasts.

Last updated: 1 November 2026

Cookies and browser storage

Cookies are small text files a website stores on your device. Handy also keeps a few items in your browser’s own storage (local storage, which stays until it is cleared, and session storage, which is cleared when you close the tab).

We use them to keep you signed in, to make sign-up and payment work, and to remember a few choices you make. Only if you click Accept on the cookie notice, we also use them to credit a partner who referred you. We do not use them for advertising or analytics.

Cookies we set

Cookie	Purpose	How long
`sb-…-auth-token-client`, `sb-…-auth-token-staff` (sometimes split into `.0`, `.1`, …)	Keeps you signed in: one for the client portal, one for the accountant and admin portals.	1 year from when it was last set. Renewed while you use Handy; a renewal by our server can set it for up to 400 days, or until you close your browser if it happens while you are being redirected.
`sb-…-auth-token-staff-code-verifier`	Completes an accountant’s Google sign-in securely.	Removed when the sign-in completes (up to 400 days if it is abandoned).
`invite_token`	Carries your accountant’s invitation through sign-in.	10 minutes or 1 hour
`expert_claim_token`	Accountants only: carries a claim link through Google sign-in.	10 minutes
`cookie-consent`	Remembers whether you clicked Accept or Reject on the cookie notice, so it is not shown again. The value is `accepted:2026-10-05` or `rejected:2026-10-05`; the date is the version of the notice you answered. If we change what Accept means, the date changes and the notice asks you again. An answer without the current date, including any given before 5 October 2026, is not used, and a referral code kept under it is removed. It covers handyapp.ai and its subdomains, so your answer also applies in the client portal.	1 year

Browser storage we use

Kept in local storage, until cleared:

Key	Purpose
`sb-…-auth-token-client-code-verifier`, `sb-…-auth-token-staff-code-verifier`	Completes a sign-in link or a Google sign-in securely. Removed when the sign-in completes.
`handy:referral-code-v1` (also in session storage)	Only if you clicked Accept on the current cookie notice: the partner referral code from a link you followed, so that partner is credited. With no current answer, or after Reject, it is not stored, and one already stored is removed when the next Handy page loads; Reject removes it straight away. After 30 days it is ignored and removed the next time Handy looks for it.
`client-theme`, `expert-theme`, `admin-theme`	Your light or dark theme.
`handy:early-access-banner-dismissed-v2`	That you closed the announcement bar.
`handy.agreementBanner.…`	Accountants only: that you dismissed the agreement reminder.
`admin-ticket-draft:…`, `admin-ticket-right-pane-width`, `admin-ticket-right-pane-collapsed`	Handy staff only: an unsent support reply (which can include a client’s details) and the layout of the support screen.

Kept in session storage, cleared when you close the tab:

Key	Purpose
`assessment`	Your answers in the free assessment, until you continue.
`from_assessment_lead_id`, `handy:pending-onboarding`, `handy:onboarding-error`	Carry your assessment and sign-up through to your account.
`invite_token`, `org_invite_token`	An invitation from your accountant or your firm.
`handy.pay.token`	The link you are paying an invoice from.
`handy.tasks.engagement`, `handy.documents.engagement`	Which of your returns you are looking at.
`handy:dot:…`	Plays a small animation only once per visit.
`admin-tickets-order`	Handy staff only: the order of the support queue.

Analytics and advertising

We do not use any. No Google Analytics, no tracking pixels, no advertising cookies. Our fonts are served from our own site, not from a font service. If that ever changes, this page changes first.

Other companies

Stripe handles card payments. Its script loads when you open the billing pages or the step where you confirm and pay, and on a payment link when the card form appears. Stripe may set its own cookies there, for fraud prevention; they are covered by Stripe’s privacy policy.
Google sets its own cookies, on Google’s site, if you choose to sign in with Google.

Managing cookies and storage

The cookie notice appears on Handy’s public pages: this website, the assessment, the CARF checker, the waitlist, onboarding, the page for accountants who want to join, and the sign-up, sign-in and password pages. It does not appear inside the client, accountant or admin portals, or on payment links, feedback forms, invitations or the refund policy, which store nothing optional.

You can change your answer to the cookie notice at any time. Reject removes a stored referral code straight away, and the partner who referred you is then not credited.

You can delete cookies and site data in your browser’s settings (search its help for “clear site data”). Doing so signs you out, and Handy cannot keep you signed in with cookies blocked.

Contact

Questions about cookies on the Handy platform? Email us at privacy@handyapp.ai.