Cookie Policy
Last updated 11 June 2026
The small number of cookies and local-storage keys D20 sets, what each one does and how to control them.
1. Our approach
D20 uses only cookies and browser storage that are strictly necessary to sign you in, keep you signed in securely and remember your preferences. We do not use advertising cookies and we do not load third-party trackers on the app.
2. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| access_token | Signs each request to the D20 API once you log in | Strictly necessary · HttpOnly, Secure | 15 minutes (refreshed automatically) |
| refresh_token | Lets D20 issue a new access token so you stay signed in | Strictly necessary · HttpOnly, Secure | 7 days |
| d20_device | Recognises this browser so we only email you about sign-ins from new devices | Security · HttpOnly, Secure | 12 months |
| Stripe (__stripe_mid, __stripe_sid) | Set by Stripe on the Checkout and Billing portal pages for fraud prevention | Strictly necessary · third party | 1 year / 30 minutes |
3. Local storage (not cookies)
| Key | Purpose |
|---|---|
| d20-theme-v2 | Remembers light or dark mode |
| d20-base-currency | Remembers the display currency for amounts |
| d20-install-dismissed | Remembers that you dismissed the 'Add to Home Screen' prompt |
4. Marketing pages
Our public pages (home, pricing, legal) set no cookies at all unless you sign in.
5. Managing cookies
Because every cookie we set is required for the Service to work, there is no cookie banner to accept or reject. You can delete cookies through your browser settings; doing so will sign you out. Blocking cookies entirely will prevent you from signing in.