1. What Cookies & Local Storage Are
Cookies are small text files a website asks your browser to keep and send back on later visits. Browsers also offer storage that only the website itself can read, such as localStorage, sessionStorage, and IndexedDB. Laws such as the EU ePrivacy Directive and UK PECR treat these alike. This Notice covers all of them.
2. What Twin Leaf Stores on Your Device
| Item | Technology | Purpose | Kept until | Type |
|---|---|---|---|---|
| Sign-in session | IndexedDB (or localStorage if IndexedDB is unavailable), set by Firebase Authentication | Keeps you signed in; holds tokens issued by Firebase Authentication and your basic profile (name, email, profile photo link) | You sign out or delete your Account on that device | Strictly necessary |
| Encrypted data cache | IndexedDB, set by Cloud Firestore | Lets Twin Leaf open quickly and work during brief outages. Holds your data in encrypted form, plus its metadata (for example month names and timestamps) | You sign out or delete your Account on that device | Strictly necessary |
| twinleaf.theme | localStorage | Remembers whether you chose light or dark mode | You clear site data | Functional preference |
| tl_diag | localStorage | Remembers that you turned on anonymous app performance and error reports on this device. Present only if you turned the setting on | You turn the setting off, or clear site data | Functional preference (set only on your choice) |
| twinleaf.lastAccount | localStorage | Pre-selects the account you last used when adding a transaction (an internal identifier, not an account number) | You clear site data (it is not removed when you sign out) | Functional preference |
| twinleaf.passcodeLetters | localStorage | Remembers that your account opens with a passcode that has letters, so the unlock screen shows a full keyboard instead of a number pad (set only if you choose it) | You clear site data, or change to a PIN | Functional preference |
| twinleaf.notTwins | localStorage | Remembers that you said two accounts are different, so Twin Leaf stops offering to merge them (internal identifiers only) | You clear site data | Functional preference |
| twinleaf.deleting | localStorage | Marks that an account deletion started on this device, so if it was interrupted the next sign-in offers to finish it (your internal account identifier, no data) | The deletion finishes, or you choose to keep the account | Strictly necessary |
| twinleaf.pendingDelete, twinleaf.flash | sessionStorage | Finishes an account deletion after re-confirming your sign-in, and shows a one-time message | The tab is closed (removed as soon as used) | Strictly necessary |
| Sign-in helper state | Storage used by Firebase's sign-in helper pages on Twin Leaf's domain | Completes the sign-in redirect or pop-up securely | The sign-in completes | Strictly necessary |
| App Check token | IndexedDB, set by Firebase App Check | A short-lived token (about an hour) proving requests come from the genuine Twin Leaf app, so our database and key service can refuse bots and abuse. It contains no personal information | It expires, or you clear site data | Strictly necessary (security) |
Your passcode, your recovery code, and your data key are not stored in your browser's storage. While Twin Leaf is unlocked, the data key and your decrypted data are held only in the app's memory; locking or signing out discards them. If you use the recovery code's Download button, your browser saves a text file wherever you choose. Your acceptance of the Terms is recorded inside your encrypted settings, not in browser storage.
3. Third-Party Cookies: Sign-In & Security
When you choose "Continue with Apple" or "Continue with Google," you interact with Apple's or Google's sign-in pages, which may set or read their own cookies on their own domains under their own policies. Loading Google's sign-in helper script also lets Google receive your IP address and browser information. Twin Leaf does not control, receive, or use those cookies.
Google reCAPTCHA. To protect the Service from bots, automated abuse and attempts to use up our free database quota, Twin Leaf uses Google's reCAPTCHA Enterprise through Firebase App Check. It runs in the background on each visit, with no puzzle to solve. Google's script collects hardware and software information, such as device and browser data and how the page is used, and sends it to Google to judge whether requests come from the real app; it may set or read its own cookies (for example _GRECAPTCHA) on Google's domains. Twin Leaf receives only a pass or fail token, never that information. Because this check is strictly necessary to keep the Service secure, it is not optional. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Google sign-in script for Gmail. If you use the optional email connection, pressing Connect Gmail loads Google's sign-in script from accounts.google.com so Google can ask for your permission. Google may set or read its own cookies and receives your IP address and browser information, under Google's policies. Twin Leaf does not load that script, or set anything for it, unless you press the button.
4. What We Do Not Use
- No advertising, retargeting, or cross-site tracking cookies.
- No third-party analytics or measurement tools and no session recording. The one measurement Twin Leaf has is its own optional, off-by-default report of load times, screen counts and errors (Settings › Privacy & data); it sends no user ID, amounts or account details and is described in the Data Sharing Notice.
- No tracking pixels, web beacons, or social-media plug-ins.
- No browser fingerprinting of our own; the only device signals collected are those Google's reCAPTCHA uses to detect abuse (Section 3).
- No third-party fonts or content networks; fonts are served by Twin Leaf itself.
5. Consent, Do Not Track & Global Privacy Control
Because Twin Leaf stores only what is strictly necessary to provide and secure the service you request (including the reCAPTCHA security check), plus preferences you set yourself, we do not show a cookie banner. If we ever propose non-essential storage, we will ask for your consent first where the law requires it, and we will treat a Global Privacy Control or Do Not Track signal as a refusal.
6. How to Control & Clear Storage
- Sign out in Settings to erase the encrypted cache and your session from that device.
- Delete your Account to erase it everywhere (see our Account & Data Deletion page); other devices keep their encrypted copy until they sign out.
- Clear site data for twinleaf-app.web.app in your browser's settings to remove everything, including preferences.
- Blocking storage for Twin Leaf will prevent sign-in and the app will not work; blocking third-party cookies generally does not affect Twin Leaf.
7. Changes
If we change what Twin Leaf stores on your device, we will update this Notice and its "Last updated" date, and give notice in the app for material changes.
8. Contact
Questions about this Notice: support@angelgatesolutions.com.
© 2026 Angel Gate Solutions, LLC. All rights reserved.