Cookie Policy

This Cookie Policy explains how Hallows Group LLC ("WorthSync") uses cookies and similar technologies on worthsync.com, app.worthsync.com and docs.worthsync.com. It should be read together with our Privacy Policy.

What are cookies?

Cookies are small text files stored on your device by your browser. They help websites work, remember your preferences, and operate securely.

How we use cookies

WorthSync uses only essential, functional and first-party measurement cookies. We do not use third-party advertising cookies or cross-site tracking, and we do not sell or share your information for advertising. Our traffic analytics (see Analytics below) are cookieless; the one measurement cookie we do set is described in the table below and never leaves our own domain.

Cookie / technology	Type	Purpose
theme	Functional	Remembers your light/dark theme preference. Set on the marketing site; expires after one year.
ws_attr	Measurement (first-party)	Records which campaign, link or page you first arrived from, so we can tell which of our own articles and pages actually bring people to WorthSync. Contains no name, email, account or advertising identifier, and is never sent to a third party. Set on worthsync.com or docs.worthsync.com, whichever you reach first, and readable by app.worthsync.com so the parts of our own site can be joined up. Set only when you arrive from a campaign link (one carrying UTM parameters) or from another website; a direct visit sets nothing. Not set where we detect that you are in the EU, EEA or UK (see below). Expires after 90 days, and is deleted as soon as it has been recorded against an account.
Authentication / session (Clerk)	Essential	Keeps you securely signed in to the app and protects your account.
Billing / checkout (Stripe)	Essential	Supports secure payment and fraud prevention during checkout.
Bot check (Cloudflare Turnstile, via Clerk)	Essential	Runs during sign-in and sign-up to tell people from automated attacks.
hg_consent	Essential	Remembers whether you chose Accept or Reject on our cookie banner, so we do not ask on every page. Shared across worthsync.com and its subdomains; expires after 180 days.

Analytics

We use Cloudflare Web Analytics to understand aggregate traffic to our marketing site (such as page views and referrers) so we can improve the site. It is privacy-first and cookieless: it does not set any cookies, does not use client-side state or device fingerprinting, and does not track you across other sites. It does not collect personally identifiable information, and we cannot use it to identify individual visitors. Because it stores nothing on your device, there is no Cloudflare analytics cookie to delete. Even so, the analytics script loads only after you click Accept on our cookie banner; if you reject, or never choose, it does not load at all.

Separately, we measure where our own visitors come from using the first-party ws_attr cookie described above. This tells us that (for example) a particular guide led to a sign-up. It is written by our site, read only by our site, contains no identifier that could follow you anywhere else, and is removed once it has been recorded. It is set only after you click Accept on our cookie banner. You can delete it at any time through your browser settings with no effect on your account.

We set ws_attr only when there is something to attribute: a campaign link (UTM parameters) or a visit referred from another website. It is not set where we detect that you are in the EU, EEA or United Kingdom: if your browser reports a time zone there (including the EU's outermost regions), or reports no time zone, we do not set it and we remove any copy set earlier. A time zone is an approximation, so this cannot be perfect. Our sites are static, so we use your browser's time-zone setting rather than your IP address to make this check; nothing is looked up or sent anywhere to do it.

Other technologies

Our web fonts and icons are self-hosted and served from our own domains on all three sites, so loading a page makes no font request to Google or any other third party, and no IP address is shared to deliver them. We use mobile push tokens (through the Expo push service) only if you enable notifications in our mobile apps.

The app at app.worthsync.com also keeps a few values in your browser's local and session storage. None of them is sent to anyone, and all are functional:

Key	Purpose
theme	Your light/dark theme choice.
wt_dashboard_layout, wt_grid_config	How you arranged the dashboard and the entry grid.
worthsync.lastActivityAt	When you last used the app, so an idle session can sign itself out.
worthsync:announcement-dismissed:*	Announcements you have dismissed.
worthsync.publicCalculatorDraft.v1	Numbers you typed into the public calculator, so they carry into sign-up.
wt_pending_snapshots	Balances you logged while offline, held until they sync. Cleared once they do.
ws_ticket_attempt:* (session storage)	Stops a one-time sign-in link from the mobile app being retried in a loop.

Managing cookies

You can control or delete cookies through your browser settings. Blocking essential cookies may prevent you from signing in or using parts of the Services. We use no advertising trackers and no cross-site cookies, so there is no advertising cookie to opt out of. Deleting or blocking the first-party ws_attr measurement cookie costs you nothing — the product behaves identically without it.

Your choice on our banner. Nothing optional (the ws_attr cookie and Cloudflare Web Analytics) runs until you click Accept. You can change your mind at any time with the Cookie settings link in the footer; choosing Reject deletes ws_attr if it was set.

Changes

We may update this Cookie Policy from time to time. Updates will be posted here with a new date at the top of the page.

Contact

Questions? Email support@worthsync.com.