Cookie & Storage Notice. Bufin

Last updated 2026-09-12

This notice explains the cookies and local storage Bufin uses. The short version: almost everything Bufin stores is strictly necessary to make the app work or to remember your own preferences, and that needs no consent. The one exception is Google Analytics, which sets cookies and is not strictly necessary, so we ask before loading it. That is what the banner is for, refusing is a single click, and refusing means nothing is loaded rather than loaded-but-ignored. We set no advertising cookies at all.

1. What we store on your device

Bufin keeps a handful of small values in your browser's local storage and session storage, not classic tracking cookies. These include: your interface language and light/dark theme; your sign-in session (a short-lived token that keeps you logged in); your accent colour, chosen font, text size, and dashboard card layout; which in-app notices you've dismissed; a cached copy of your data so the app loads instantly and works offline (a "stale-while-revalidate" cache); the onboarding-complete flag; and, briefly, a pending purchase or household-invite token while you sign in. All of it stays on your device.

Two more were added in September 2026, and they exist to make a counter honest rather than to remember a preference: a marker saying this browser has already been counted once, and the calendar month it was last counted in. They are what stop the "how many browsers use Bufin" figure from counting the same browser on every page load. Neither is ever sent back to us, neither identifies you, and switching analytics off in Settings → Privacy deletes both.

None of these identify you to advertisers, follow you across other websites, or build a profile of you. They exist only so Bufin remembers your settings and keeps you signed in.

If you use Bufin WITHOUT an account, one more thing lives in that same local storage: your entire budget. That is the whole design of no-account mode: nothing is sent anywhere, so nothing needs to be trusted to anyone. It also means the warning in section 5 is not a small one for you: clearing your browser's site data for Bufin deletes the budget itself, not just some preferences. Private/incognito windows discard it when they close, it exists on that one device only, and there is no backup anywhere. Export a copy from Settings → Data, or sign in to move it to your own Google Drive or OneDrive.

2. Sign-in and security

When you sign in, our authentication providers may set essential values needed to complete and secure the login: Google or Microsoft during their sign-in flow, and Cloudflare Turnstile, which runs a privacy-friendly "are you human?" check to block bots. Turnstile is designed not to track users across sites. These are strictly necessary: sign-in cannot work without them.

3. Analytics: three different things, only one of which needs consent

First, our own measurement, served from our own server: counts of which pages are opened and which labelled buttons are clicked, folded into daily totals per page. It sets NO cookie and no tracking identifier of any kind. The single value it keeps on your device is your own opt-out flag, written only if you turn analytics off in Settings → Privacy, which is the opposite of tracking and needs no consent.

Second, Google Analytics 4. This is the one the banner is about: it is Google's, it sets cookies (_ga and _ga_*), and it is the only reason this site asks you anything. It loads only if you accept, advertising features are disabled in our configuration, and you can withdraw at any time in Settings → Privacy, which deletes its cookies.

Third, Cloudflare Web Analytics, run by our hosting provider. It counts page views, referrers, country, browser and load times. It is cookieless: it writes nothing to your device and sets no identifier, which is why it is listed here but is not part of the consent banner, and why declining the banner does not change what it does. It is never used for advertising and its data is never sold.

It cannot identify or follow you: no account id, no session id, no device id, no IP address kept, no timestamp finer than the day, and nothing from your finances. Global Privacy Control and Do Not Track are honoured automatically. Blocking our endpoint with a content blocker works too, and Bufin behaves exactly the same either way. See the Privacy Policy for the full detail.

One page deliberately has none of this: status.bufin.app. It sets no cookie, stores nothing on your device and runs no analytics at all, not even our own counter. It is the page people open when they cannot use the app, and measuring someone at that moment would be a strange choice; it also means the page has no dependency that could be the reason it fails to load.

4. No advertising, and what the third parties actually are

We run no ad networks, no marketing pixels, no session recording, no heatmaps and no cross-site advertising trackers. Three third parties do run: Google Analytics 4 (sets cookies, consent-gated, does nothing at all if you decline), Cloudflare Web Analytics (cookieless traffic counting), and Cloudflare's bot and abuse protection including Turnstile (a security measure, strictly necessary, and the reason a scripted attack on the sign-in page does not get very far). None of the three is used for advertising. We do not sell or share any of the values stored on your device.

5. How to clear or control it

You're in control: sign out to drop your session, or clear your browser's site data for Bufin at any time to wipe everything we've stored (you'll simply be signed out and your preferences reset). Blocking essential storage may stop sign-in or your saved settings from working, but nothing bad happens: the app just forgets your preferences.

6. Changes & contact

If we ever start using storage in a materially different way, we'll update this notice and, where the law requires it, ask for your consent first. Questions: [email protected]. See also our Privacy Policy.