1. What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work more efficiently, provide analytics information, and remember your preferences.

2. How BillOak Uses Cookies & Storage

BillOak uses minimal cookies and browser storage. We are committed to transparency about what we store and why.

3. Cookie Consent

In the European Economic Area, the UK, and Brazil — jurisdictions that require opt-in consent before non-essential cookies are set — we show a cookie consent banner when you first visit BillOak, with three options:

Accept All: Enables both essential and analytics cookies.
Essential Only: Only essential cookies are used. No analytics data is collected.
Manage Preferences: Opens a panel where you can toggle individual cookie categories.

Your preferences are stored in your browser's local storage (billoak-cookie-consent) and remembered for future visits. You can change your preference at any time by clearing this value from your browser storage — the consent banner will reappear on your next visit.

3a. Region-Based Consent

Outside jurisdictions that legally require opt-in consent, analytics cookies are enabled by default without showing the banner, so most visitors won't see it. We determine your region from your IP address at the network edge (via our hosting provider, Vercel) — this check happens before the page loads and the country information itself is not stored or logged by BillOak. If we can't determine your region, we default to showing the banner and asking first. Regardless of region, you can always opt out — see "Managing Your Data" below — and an explicit Do Not Track or Global Privacy Control signal from your browser always overrides this default (see Section 9).

3b. Cookie Categories

Essential (always on): Required for the site to function. Includes local storage for invoice data, preferences, hosting cookies, and Cloudflare Turnstile cookies on the Contact page. These cannot be disabled as the site — or the Contact form — would not work without them.
Analytics (optional): Google Analytics cookies used to understand site usage. Fully optional — the site works perfectly without them.

4. Local Storage (Not Cookies)

BillOak primarily uses browser local storage (not cookies) to save your data. Local storage is different from cookies — it never gets sent to any server and stays entirely on your device.

We store the following in local storage:

billoak-storage: Your invoice data, history, language preference, and customization settings (accent color, font, PDF layout). Essential for the app to function.
billoak-tour-done: A flag indicating whether you have completed the welcome tour.
billoak-cookie-consent: Your cookie preference choice (accepted/rejected).

Local storage does not require consent under GDPR as it is strictly necessary for the service you requested.

5. Analytics Cookies (Require Consent)

These cookies are only loaded if you accept via the cookie consent banner:

_ga: Used to distinguish unique users. Expires after 2 years.
_ga_*: Used to persist session state. Expires after 2 years.

These cookies collect anonymized data about how visitors use the website (pages viewed, time spent, general location). We enable IP anonymization. No personal or invoice data is ever included in analytics.

6. Essential Cookies

Our hosting provider (Vercel) may set essential cookies required for security, load balancing, and content delivery. These are strictly necessary for the website to function and do not require consent.

6a. Vercel Web Analytics (Cookieless)

We use Vercel Web Analytics to understand basic traffic patterns (page views, referrers, country, device type). This tool does not use cookies, does not set any persistent identifier, and does not collect personal data — it runs for all visitors regardless of your cookie consent choice, consistent with regulatory guidance that cookieless, non-identifying measurement does not require consent under GDPR.

6b. Cloudflare Turnstile (Contact Page Only)

The Contact page uses Cloudflare Turnstile to verify you're not a bot before your message is sent, instead of a traditional CAPTCHA. Turnstile may set cookies and process your IP address and browser signals for this purpose. It is only loaded on the Contact page — it does not run anywhere else on the site — and is essential for that page to prevent spam, so it is not gated by the analytics cookie consent choice.

7. Third-Party Cookies

Beyond Google Analytics (if accepted) and Cloudflare Turnstile (Contact page only, for spam prevention), we do not use any:

Advertising or remarketing cookies
Social media tracking cookies
Cross-site tracking cookies
Third-party analytics cookies

8. Managing Your Data

You have full control over all data stored by BillOak:

Change cookie consent: Clear billoak-cookie-consent from your browser's local storage — the consent banner will reappear on your next visit.
Clear invoice history: Use the "Clear All" button on the History page.
Export your data: Use the Export feature to download your invoices as JSON.
Clear all BillOak data: Open your browser's Developer Tools → Application → Local Storage → delete entries starting with "billoak".
Clear cookies: Use your browser's built-in cookie management to clear cookies from billoak.com.
Opt out of analytics: Install the Google Analytics Opt-out Browser Add-on.

9. Do Not Track & Global Privacy Control

BillOak respects Do Not Track (DNT) and Global Privacy Control (GPC) browser signals. If your browser sends either signal, we will not load analytics scripts, regardless of your region or any previous consent choice — this check happens on every visit, before any analytics script would otherwise load.

10. Updates to This Policy

We may update this Cookie Policy as we add new features or change our analytics approach. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For questions about this Cookie Policy, please contact us.