Cookie Policy – PayAudit

Version: 2026-10-10 Controller: PayAudit – info@payaudit.eu

1. Summary

PayAudit uses only technical cookies that are strictly necessary to sign you in and keep you signed in to the web application. We use no analytics, advertising, profiling or social media cookies, and no third-party tracking pixels. For this reason no cookie consent banner is shown. This reflects our reading of art. 122 of the Italian Privacy Code, implementing art. 5(3) of the ePrivacy Directive, and of the Garante’s cookie guidelines of 10 June 2021.

The public website (free tools, waitlist, pricing) sets no cookies of its own. Waitlist sign-up and the free tools work without cookies; payroll files used in the free tools are processed in your browser and are not sent to us.

2. Cookies we set

Name	Purpose	Set when	Duration	Attributes
__Host-sid (sid outside production)	Session: keeps you signed in to the app. It contains a random 32-byte token; the server stores only a SHA-256 hash of it.	After you sign in with an email link or with GitHub/Google	30 days, renewed while you use the app (“sliding”); deleted when you sign out	HttpOnly, Secure, SameSite=Lax, Path=/, first-party (app domain only)
oauth_state	Security of sign-in with GitHub/Google: holds the anti-forgery state, the PKCE verifier, the page to return to and the chosen provider, signed with HMAC so it cannot be altered	When you click “Continue with GitHub/Google”	10 minutes; deleted as soon as you return from the provider	HttpOnly, Secure, SameSite=Lax, Path=/api/auth/oauth, first-party

Both cookies are strictly necessary: without them you cannot sign in. They are not used to track you, and they are not shared with third parties.

3. Third-party services

• Cloudflare Turnstile (anti-bot check on the waitlist and sign-in forms). Turnstile runs a check in your browser on our behalf. [NOT VERIFIED: whether Turnstile sets or reads cookies or similar storage, and how Cloudflare classifies them; check Cloudflare’s current documentation before publication.]
• Cloudflare network (hosting and security). Cloudflare may set security cookies (for example for bot management) on the domains it serves. [NOT VERIFIED: which cookies, if any, are set with the configuration we will use; to be checked on the deployed site.]
• GitHub and Google sign-in pages set their own cookies when you use them. Those are governed by the providers’ own policies; we do not control or read them.

4. Analytics without cookies

We measure product usage with our own cookieless analytics: events are stored on our servers with a date (no time) and without cookies, device fingerprints or cross-site identifiers. See the Privacy Policy for details.

5. Other browser storage [TO CONFIRM]

The application may store non-identifying preferences (for example the chosen language) or keep payroll files you load only in your browser’s memory or local storage, so that they never reach our servers. [TO CONFIRM: list each localStorage/IndexedDB key once the front-end is complete; not present in the code reviewed on 2026-10-10.]

6. How to control cookies

You can delete or block cookies in your browser settings. If you block the cookies listed in section 2 you can still use the public website and the free tools, but you cannot sign in to the application.

7. Changes

If we add any cookie that is not strictly necessary, we will ask for your consent before setting it and update this policy with a new version date.

8. Contact

info@payaudit.eu. See also the Privacy Policy (privacy-policy.md).