Cookie Policy
Version 2026-04-22. In force from 22 April 2026.
1. Our approach
We use the fewest cookies we can. The default on first visit is decline all optional cookies. We do not use marketing cookies. We do not use cross-site tracking.
2. Categories
- Strictly necessary (default: on) — Cookies needed for the site to function. Disabling them breaks the site — they are on by default and cannot be turned off.
- Functional (default: off) — Remember your preferences. Default off. Turning them on improves the experience (e.g. remembering which business you last used).
- Analytics (default: off) — We do not currently use analytics cookies. If we introduce them, they will default to off and only switch on if you opt in - no personal information would be collected, only counts and timings.
- Marketing (default: off) — We do not use marketing cookies and have no plans to. Listed for completeness.
3. Specific cookies
Cookies and local storage entries below marked with a trailing colon or dash (e.g. tax-progress:) are followed by an identifier for the business or record they belong to.
| Category | Name | Stored as | Purpose | Retention |
|---|---|---|---|---|
| Strictly necessary | authjs.session-token | Cookie | Keeps you signed in. The __Secure- prefixed variant is used in production over HTTPS. Cannot be disabled - the application will not function without it. | 12 hours (or 1 hour of inactivity, whichever is sooner) |
| Strictly necessary | authjs.csrf-token | Cookie | Prevents cross-site request forgery on sign-in and other form submissions. | Browser session |
| Strictly necessary | authjs.callback-url | Cookie | Remembers where to return you after signing in with Google or Microsoft. | Browser session |
| Strictly necessary | appventure_portal | Cookie | Keeps an employee signed in to the Employee Portal (payslips, leave requests). A separate, independent session from the business owner/admin login above. | 12 hours |
| Strictly necessary | ap1.cookieConsent | Browser storage | Remembers your cookie choice, including a choice to allow only what is necessary, so we can honour it and don't ask again every visit. | Until you change your choice or clear your browser data |
| Functional | av1:getting-started-dismissed:… | Browser storage | Remembers that you dismissed the getting-started checklist for a business. | Until you clear your browser data |
| Functional | av.activeWorkflow.… | Browser storage | Remembers which guided workflow (e.g. month-end close) you were on for a business, so it resumes where you left off. | Until the workflow finishes or you clear your browser data |
| Functional | ops:invoice-draft:… | Browser storage | Recovers an unsaved invoice or credit-note draft if your browser closes before you save. | Until you save or discard the draft |
| Functional | cipc-intake-… | Browser storage | Remembers your answers in the CIPC annual-return guide for a business's financial year. | Until you clear your browser data |
| Functional | tax-progress:… | Browser storage | Caches your progress through a tax return so it loads instantly on your next visit. | Until you clear your browser data |
| Functional | accruals-register-v2-intro:… | Browser storage | Remembers that you dismissed the accruals register's introduction card. | Until you clear your browser data |
| Functional | portal_builder_email | Browser storage | On the Employee Portal sign-in page, remembers the Appventure team email used for internal testing sign-in. | Until you clear your browser data |
4. Managing your preferences
On first visit you are offered a cookie consent banner. You can change your choice at any time by clicking Cookie preferences in the footer of every page, or from the Cookie preferences section under Settings → Privacy.
5. Browser controls
Your browser also provides cookie controls. Blocking strictly-necessary cookies will break the site; that is expected.