Cookie policy

What changed: Added the key that remembers your closing-sheet float for the next market day.

The short version

PayBrisk runs no advertising, no analytics and no tracking pixels. The only script from anybody else is Cloudflare’s bot check on the sign-in page, when it is switched on. We set the cookies the site needs to work, and one optional cookie that we only set if you say yes.

The one we ask about

pb_ref, kept for 30 days. If you arrive by pressing the small “Powered by PayBrisk” link on somebody’s bill or page, or a link we handed out on a flyer or in a post, it remembers which kind of link that was and, for a seller’s page, that seller’s public link name. If you then make an account, we keep that pair on it so we know which links bring people here. It says nothing about you or anything you paid. Nothing is set until you press Allow, and saying no changes nothing else on the site. If your browser sends Global Privacy Control or Do Not Track, we take that as no: we do not ask, and we never set it.

Cookie settings — change your answer at any time. It is also at the bottom of every page.

The ones the site needs

These are set without asking, because the site cannot work without them.

• authjs.session-token (or __Secure-authjs.session-token): Keeps you signed in. Removed when you sign out. (30 days)
• authjs.csrf-token, authjs.callback-url, and for Google sign-in authjs.state and authjs.pkce.code_verifier: Protect the sign-in form and remember where to send you after it. (Until you close the browser)
• paybrisk_impersonation: Only on a PayBrisk staff member's browser, while they look at an account read-only to help its owner. (30 minutes)
• pb_consent: Remembers your answer to the cookie question, so we do not ask on every page. (6 months)
• paybrisk_dev_session: Only on a developer's own computer while building PayBrisk. Never set on the live site. (1 day)

What your browser keeps

Not cookies, and never sent to us, but stored on your device all the same:

• paybrisk:install-dismissed: Remembers that you closed the offer to install the app on your phone. (Until you clear your browser)
• paybrisk:start: Keeps a bill you started on the Start page while you go and check your email. (Until you close the tab)
• paybrisk:start-stall: Keeps the stall name and items you typed on the Start page while you go and check your email. (Until you close the tab)
• pb-cart:<seller>: The items you picked on a seller's menu, so a lost signal or a reload does not empty your cart. (2 hours)
• pb-outbox-v1: An order or sale your phone could not send for lack of signal, kept until it goes through. (Until sent, at most 7 days)
• pb-tin:<day>: The float and cash count you typed on a closing sheet, so reopening it does not lose them. (Until you clear your browser)
• pb-float: The float you last typed on a closing sheet, filled in again on your next market day. (Until you clear your browser)
• pb-market-email: Your market manager's email address, typed on the closing sheet, so you do not retype it every week. (Until you clear it or your browser)
• pb-takes-tokens: Whether you turned on the market token button on your register. (Until you clear your browser)
• paybrisk_admin_nav_collapsed: Only for PayBrisk staff: whether the back office menu is folded away. (Until you clear your browser)
• Saved pages: Copies of a seller's own pages, so they open without signal. (Until you sign out)
• Offline page: One page shown when your phone has no signal. It holds nothing about you or your money. (Until the next version of the site)

If this ever changes

We will not add analytics, advertising or any other tracker without first asking you on this site, with a banner where no is as easy as yes, and listing it here. Until then the only question we ask is the one about pb_ref.

Getting in touch

Questions go to support@paybrisk.app. How we handle everything else about you is in the privacy policy.