Cookie Notice
Effective August 12, 2026
This page lists every cookie ShadowLedger sets and what each one is for. There are no third-party cookies, no advertising cookies, and no cross-site tracking of any kind on this site or in the application.
Why there is no cookie banner
In the UK and the European Economic Area, storing anything on a visitor's device needs consent first unless it is strictly necessary to provide something the visitor asked for. Analytics does not meet that test, which is why most sites show a banner.
We took the other option. If you are visiting from the UK or the EEA, we do not set the analytics cookie at all, and we do not read one if you have it. The visit is still counted, using an identifier that exists only for the length of that single request and is never stored on your device. Nothing is written to your device, so there is nothing to ask permission for. The cost is ours: our own traffic numbers are less precise for those visitors, because we cannot tell a returning reader from a new one.
The remaining cookies are the ones that keep you signed in and remember a setting you chose. Those are strictly necessary or set at your own request, and neither needs a banner.
The cookies we set
| Cookie | Purpose | Lifetime |
|---|---|---|
| Clerk session cookies | Keeps you signed in and protects the sign-in form against cross-site request forgery. Set by our authentication provider. Strictly necessary: without them there is no way to be logged in. | Until you sign out or the session expires |
sl_an | First-party analytics. Ties the pages of one visit together so we can see which parts of the site are read. It holds a random identifier and nothing else. Not set for visitors in the UK or the EEA, and not set at all if your browser sends a Do Not Track or Global Privacy Control signal. | 30 minutes of inactivity |
sl_theme | Remembers whether you chose the light or dark theme. Set only when you pick one, and read on the server so the page does not flash the wrong colours before it loads. | One year |
sl_client | For firm accounts: which client workspace you are currently looking at. Signed-in application only. | Until replaced or you sign out |
sl_sidebar | Remembers whether you collapsed the application sidebar. Signed-in application only. | One year |
qbo_oauth_state and equivalents | Set for the few seconds of connecting an accounting system, to verify that the response coming back is the one we sent you to. Strictly necessary and security related. | The length of the connection flow |
| Stripe cookies | Set by Stripe on their own hosted checkout and billing pages, for fraud prevention and to make the payment form work. They are not set by this site. See Stripe's own cookie notice. | Set and controlled by Stripe |
What we do not do
- No third-party analytics script. We count traffic on our own servers.
- No advertising or retargeting pixels, and no data sold to anyone.
- No device fingerprinting, and no IP address stored with a page view.
- No tracking across other websites. A cookie we set is readable only by us.
Turning things off
Send a Do Not Track or Global Privacy Control signal and we record nothing at all for that visit, everywhere in the world, not only where the law requires it. Most browsers can also block or clear cookies directly. Blocking the analytics cookie changes nothing about how the product works. Blocking the authentication cookies will stop you being able to sign in, since being signed in is what they are.
More detail
What we record about a visit, how long it is kept, and who else sees any of it is covered in the Privacy Policy.