DAYRUNNER / POLICIES

Cookies and device storage

Policy version: 2026-09-08

Dayrunner uses an essential Flask session cookie for signed-in sessions, form security and temporary messages. It is configured as HttpOnly, SameSite=Lax and Secure on HTTPS deployments. Choosing “Keep me signed in” makes it last up to 30 days. Without that choice it is a browser-session cookie, and server access expires after 12 hours. Browser session restoration may preserve a session cookie, but server expiry still applies. Signing out revokes the current session.

Local storage remembers your chosen theme (dr-theme), home-screen prompt dismissal (ios-install-dismissed) . A signed, essential dr_privacy cookie stores your privacy choice. It expires after 180 days or a policy-version change. Other preferences remain until you clear browser storage.

Optional analytics

When enabled and accepted, Dayrunner sends a count for a public page to its own server. It uses no analytics cookie or third-party analytics script. It sends no private page paths, account identifiers or advertising IDs. The server receives the normal network request, but the analytics table stores only the day, public page and count. Declining analytics does not affect your account or payments. A browser Global Privacy Control signal disables these counts.

External services

Fonts and icon styles load from external providers. These requests may disclose network information even if analytics is declined. Stripe Checkout and Stripe account pages are separate services with their own cookie notices. Dayrunner's preference controls do not change those providers' settings.