Cookies and device storage
How Get Me Paid uses browser and device technologies
This notice explains the cookies, browser storage, service-worker caching and related technologies used to provide and protect Get Me Paid.
Last updated: 3 July 2026
Get Me Paid is operated by OSTOYA DIGITAL SOLUTION LTD, company number 17290506.
Registered office: 32 Mayfly Road, Swaffham, England, PE37 8JF.
Legal and privacy contact: legal@ostoya.io.
This notice should be read alongside the Privacy Notice.
Summary
Key points in plain English
- Authentication cookies keep signed-in users connected securely.
- Browser storage may remember explicitly selected PWA preferences, such as install state or a temporary install-prompt dismissal.
- The service worker caches selected static application assets and the offline page for PWA operation.
- Push-notification technology is used only after a signed-in user enables notifications and grants browser permission.
- Google Analytics 4 is used on public marketing pages only after a visitor accepts optional analytics cookies.
- Stripe, Google and Microsoft may use their own technologies on their own services when a user chooses those hosted flows.
The inventory may change when features, providers or legal requirements change.
What cookies and similar technologies are
Cookies are small stored values associated with a website. Similar rules can apply to other technologies that store information on, or access information from, a browser or device.
Examples can include localStorage, service workers, Cache Storage, app storage, push-subscription state and device identifiers. Not every server-side account record is a cookie or device-storage technology.
This notice separates browser or device storage from server-side records such as account details, invoices, Terms acceptance, billing records and notification-subscription records held in the application database.
Technologies we use
This public inventory is derived from a typed storage configuration and an internal repository audit. It avoids showing token contents, private identifiers, OAuth tokens, push keys or speculative provider-cookie names.
| Name or pattern | Provider | Mechanism | Purpose | When used | Duration | Classification | Consent required |
|---|---|---|---|---|---|---|---|
| Better Auth session cookie pattern | Get Me Paid / Better Auth | Cookie | Keeps a signed-in user connected to their account and supports account security. | After registration auto sign-in where enabled, login or authenticated session refresh. | Session or determined by the authentication configuration; production runtime duration requires verification. | necessary | No |
| Authentication flow security cookies or equivalent state | Get Me Paid / Better Auth | Cookie | Protects authentication, email verification, password reset and redirect flows where the authentication library uses browser state. | During authentication, verification, reset or callback flows if required by Better Auth. | Short-lived or session-based where used; exact runtime values require production verification. | necessary | No |
| ostoya_pwa_installed | Get Me Paid | localStorage | Remembers that the app has been installed or opened in standalone display mode so install prompts are not shown unnecessarily. | When the browser reports app installation or the app runs in standalone PWA mode. | Persistent until the user clears site data or the application overwrites it. | functional | No |
| oi-install-dismissed-until | Get Me Paid | localStorage | Remembers a user-selected dismissal of the PWA install prompt for a short cooldown period. | When a user selects Not now on the install prompt. | Seven-day timestamp, then ignored by the application; removable by clearing site data. | functional | No |
| gmp-analytics-consent | Get Me Paid | localStorage | Remembers whether the visitor accepted or rejected optional analytics so the choice can be honoured on future visits. | When a visitor selects Accept analytics or Reject analytics in the public-site cookie controls. | Persistent until the visitor changes the choice or clears site data. | functional | No |
| /sw.js service-worker registration | Get Me Paid | Service worker | Supports the installable app experience, update prompts, offline fallback and web push handling. | In production, or in development only when explicitly enabled by NEXT_PUBLIC_ENABLE_SW_IN_DEV. | Persistent until the user unregisters the service worker, clears site data or the browser removes it. | necessary | No |
| ostoya-static-* | Get Me Paid | Cache Storage | Caches the offline page and selected static application assets for PWA operation. | When the service worker installs or fetches eligible static assets. | Until service-worker version cleanup, browser eviction, PWA removal or clearing site data. | necessary | No |
| Browser push subscription | Browser / push service / Get Me Paid | Push subscription | Allows requested invoice-reminder and test notifications to be delivered to an enabled browser. | Only after a signed-in user selects Enable notifications and grants browser permission. | Until unsubscribed, revoked in browser settings, cleared as site data or invalidated by the browser push service. | functional | No |
| Google Analytics 4 cookies | Google Analytics | Cookie | Measures visits to public marketing pages and their acquisition source, such as search, social media, referrals and direct visits. | Only after a visitor accepts optional analytics through the Get Me Paid cookie controls. | Google Analytics cookie duration is controlled by Google and browser settings; production values must be verified after deployment. | analytics | Yes |
| Stripe-hosted checkout and billing pages | Stripe | External provider | Provides subscription checkout and supported billing management on Stripe-controlled pages. | When an authenticated organisation user chooses to open Stripe Checkout or billing management. | Controlled by Stripe on Stripe services; not set by Get Me Paid on Get Me Paid pages. | necessary | No |
| Google and Microsoft OAuth provider pages | Google / Microsoft | External provider | Connects optional email-sending integrations when an organisation chooses that provider. | When a signed-in user starts the relevant OAuth connection flow. | Controlled by the provider on its own services; resulting tokens are stored server-side by Get Me Paid where implemented. | functional | No |
Authentication and security
Better Auth is used for registration, login, sessions, email verification and password reset flows. Its session cookie pattern is used to keep a signed-in user connected to the correct account and to protect authenticated routes.
OAuth state for the optional Google and Microsoft email integrations is stored server-side in the verification table, not as a Get Me Paid browser cookie identified in the source audit. Provider pages may use their own cookies on their own domains.
Disabling essential authentication cookies may prevent login or authenticated use. Logging out removes or invalidates the session through the authentication system. Production cookie attributes and exact durations must be verified in the deployed HTTPS environment because library behaviour can differ between HTTP development and HTTPS production.
Preferences and PWA storage
The application uses localStorage for PWA install state and install-prompt dismissal only where the user or browser has taken an installation-related action. The identified keys are ostoya_pwa_installed and oi-install-dismissed-until.
The public-site cookie controls use the gmp-analytics-consent localStorage value to remember whether a visitor accepted or rejected optional analytics. It stores that choice, not an analytics identifier, and prevents Google Analytics loading before consent.
These values do not contain account records, invoice data or payment details. They can be removed by clearing site data. Removing them may cause the install prompt to appear again or cause the site to ask for the analytics choice again.
No application-managed sessionStorage or IndexedDB keys were identified during the repository audit.
Service-worker caching
A service worker supports the installable web-app experience, update prompts, offline fallback and push-notification handling. It registers /sw.js in production, or in development only when service-worker registration is explicitly enabled.
The service worker caches the offline page and selected static assets such as Next.js static files, icons, the manifest and favicon. It does not describe the product as a fully offline accounting system.
The service-worker source excludes API routes, authenticated app pages, invoice PDF/send routes, customer and invoice pages, billing/settings pages, authentication pages, onboarding, verification/reset paths and non-GET requests from intentional caching. Users can remove cached app data through browser site-data controls, by unregistering the service worker or by uninstalling the PWA.
Push notifications
Push notifications require a signed-in user action and browser permission. A browser push subscription is created only after the user enables notifications in the application and the browser grants permission.
The browser, device and browser push-service provider participate in delivery. Get Me Paid stores the endpoint and keys needed to deliver messages server-side; this server-side record is separate from cookies.
Users can disable notifications in Get Me Paid settings where available and in browser or device settings. Browser support and delivery reliability vary.
External providers
Google Analytics
- Google Analytics 4 is loaded only on public Get Me Paid marketing pages after a visitor accepts optional analytics cookies.
- It is used to understand high-level acquisition sources, such as search, social media, referrals and direct visits, and public-page performance.
- The Google tag is not loaded in the signed-in dashboard, including customer, invoice, settings and billing pages.
Stripe
- Subscription checkout and supported billing management occur on Stripe-hosted pages.
- Stripe may use cookies and similar technologies on Stripe-controlled services. Get Me Paid does not inventory every Stripe-domain cookie in this first-party notice.
- Get Me Paid does not set Stripe cookies on Get Me Paid pages in the source audit.
Google and Microsoft email integrations
- These OAuth flows are used only when an organisation chooses the relevant email integration.
- Users are redirected to provider-controlled services, where the provider may use its own technologies.
- Server-side access and refresh tokens stored by Get Me Paid are not browser cookies set by Get Me Paid.
Transactional email and hosting
- Infrastructure and email providers are not listed as cookie providers unless they store or access information on a user device.
- Production hosting injection of analytics or monitoring should be reviewed whenever hosting, deployment templates or third-party services change.
Optional analytics and advertising
Get Me Paid uses Google Analytics 4 on public marketing pages only after a visitor selects Accept analytics. The integration records page views and approved campaign parameters, such as UTM values, to understand acquisition channels and public-page performance.
The integration does not load in the signed-in invoice application. Google Signals and Google ad-personalisation signals are disabled in the configured tag.
Get Me Paid does not currently use advertising pixels or behavioural advertising technologies on its own pages. This statement does not cover provider-controlled pages such as Stripe, Google or Microsoft, and the inventory will be reviewed before any material change.
Consent and exemptions
Google Analytics is treated as optional. The Google tag does not load until a visitor selects Accept analytics in the public-site cookie controls.
Rejecting analytics prevents future Google Analytics measurement and removes Google Analytics cookies that Get Me Paid can access. Visitors can reopen Cookie settings in the footer to change their choice.
Current first-party technologies are used for essential service and security functions, explicitly requested PWA functionality, or preferences selected by the user. Future non-essential technologies must be reviewed before deployment and must not load until valid consent has been obtained where required.
Managing and deleting storage
Visitors can change the analytics choice through Cookie settings in the website footer. They can also clear site cookies, clear site data, remove local storage, unregister service workers, clear Cache Storage, revoke notification permission, unsubscribe from push notifications and uninstall the PWA using browser or device controls.
Clearing session cookies logs the user out. Clearing app data may remove cached assets, PWA preferences and the remembered analytics choice. Disabling essential cookies may prevent account use. Disabling notifications stops push delivery on that browser or device.
Server-side records are separate
Clearing browser data does not automatically delete account records, organisation records, invoices, customer records, billing records, Terms acceptance, server-side notification-subscription records or contact correspondence.
For personal-data requests, account questions or closure requests, read the Privacy Notice or contact Get Me Paid.
Changes to this notice
This notice will be updated when technologies, purposes, providers, legal guidance or consent requirements materially change. The version and date should be updated for material changes.
Contact
For questions about this storage inventory, privacy, account information or deletion requests, email legal@ostoya.io or use the Get Me Paid contact page.
OSTOYA DIGITAL SOLUTION LTD, company number 17290506. Registered office: 32 Mayfly Road, Swaffham, England, PE37 8JF.
Official UK guidance and legislation reviewed for this notice: ICO public cookies information, ICO storage-and-access technology guidance, ICO exceptions and consent guidance, PECR regulation 6 on legislation.gov.uk, the Data (Use and Access) Act 2025 on legislation.gov.uk, and GOV.UK commencement guidance.