Cookie Policy

Clove Ai sets one strictly-necessary cookie, and only once you sign in: your session. It is httpOnly, so no script on the page can read it. Your preferences are kept in your browser's local storage.

Everything else we store is needed to provide the Service you asked for: keeping you signed in, remembering your settings, and showing your data quickly.

The one optional part is Google Analytics 4, which tells us in aggregate how the website is used. It is off until you choose Accept in the cookie banner: before that, no analytics script is loaded, no analytics cookie is set and no request goes to Google. Reject keeps it off. You can change your mind at any time from Cookie settings in the footer.

We do not run advertising or cross-site tracking. Fonts are served from our own domain, so loading a page does not hand your IP address to a font service.

These are required for the service to work at all. They cannot be switched off, and under UK/EU rules they do not require consent.

• clove_session (cookie, httpOnly, secure, SameSite=Lax): keeps you signed in. Set when you sign in, cleared when you sign out, and expires after 30 days without use. Whether you have passed two-factor authentication is recorded on our server against this session, not in a separate cookie.

• clove_oauth (cookie, httpOnly, secure, SameSite=Lax): exists only for the few minutes of a "Continue with Google / GitHub" sign-in, to check that the provider sent you back to the same browser. Deleted as soon as that sign-in finishes.

Under the ePrivacy Directive (and the UK PECR), storage that is strictly necessary to provide a service the user has requested does not require consent. Everything listed on this page falls into that category.

Analytics is not strictly necessary, so it is covered separately below and only runs with your consent. The Android app contains no analytics SDK, advertising pixel or cross-site tracker.

These live in your browser's local storage. They stay on your device, are not transmitted to us as part of ordinary requests, and are removed if you clear site data.

• clove-theme, clove-brand: light/dark mode and accent colour.

• clove-rates-v1: a cached table of currency exchange rates, so converted totals render without refetching public rate data on every page. It contains no personal data.

• clove-confirm-delete, clove-haptics, clove-streak-card-style: interface preferences you set in the app.

• clove-reminder-prefs, clove-reminder-browser, clove-reminder-history-<your id>, clove-dismissed-notes-<your id>, clove_onboarding_<your id>: your reminder settings, which reminders and notes you have already seen or dismissed, and that you finished the first-run tour.

• clove-get-app-last-shown, clove-get-app-never, clove-get-app-session-dismissed (session storage): whether you dismissed the "get the app" prompt, so it does not keep returning.

• clove-sessions-<your id>: your AI chat history, kept only in this browser and never saved on our servers. Pictures you attach are not kept in it. Removed when you sign out.

• clove-suggestion-usage: counts of which topics you ask the assistant about, so the suggested prompts get more useful. It stores topic labels and counts only. It never stores your messages, and it is never sent to a server.

• clove_expenses_…, clove_budgets_…, clove_profile_…: cached copies of your own expenses, budgets and profile so pages show instantly while fresh data loads. Removed when you sign out.

• clove-synced-timezone: the last timezone we sent, so we do not repeat the call on every launch.

• clove-cookie-consent-v1: your answer in the cookie banner (analytics on or off) and when you gave it, so we do not ask again on every visit and can show that you agreed.

We use Google Analytics 4 on the website, including the signed-in web app, to see in aggregate which pages are visited, how people arrive and where they leave, so we can improve the product. It loads only after you choose Accept in the cookie banner. The address it receives for a page contains only the site and path, never a query string or fragment.

• _ga (cookie, 2 years) and _ga_<id> (cookie, 2 years): set by Google Analytics to tell visits apart and keep a session. They contain a random identifier, not your name, email or financial data.

Google Analytics 4 does not log or store IP addresses. We do not send it your account details, your expenses or anything you type into the app, and we do not use it for advertising (Google signals and ad personalisation are off).

If you withdraw consent, analytics stops immediately and these cookies are deleted. There are no marketing or advertising cookies.

We do not sell personal information, and we do not share it with advertising networks.

Some providers necessarily receive your IP address when your browser or our server talks to them. They are described in the Privacy Policy under sub-processors. They do not set advertising cookies through this site.

• Our hosting provider: serves the site, runs the database that stores your account, and keeps security logs.

• Google or GitHub: only during a "Continue with …" sign-in you start, on their own pages.

• Our AI provider: receives the text and images you send to AI features, only when you use them and have turned AI features on.

• Xendit: only when you choose to pay on the web, on its own payment page.

• Google (Google Analytics 4): only if you accepted analytics cookies, receives page visits and technical details of your browser.

Analytics: choose Accept or Reject in the cookie banner the first time you visit, and change it any time from Cookie settings in the footer. Other controls are in the app: theme and accent under Settings, and, separately, whether AI features may send your text and images to a third-party provider, which is off until you turn it on and can be turned back off in one tap.

You can clear everything from your browser settings (Clear site data / Clear cookies). This signs you out and resets your preferences to defaults; your account and financial records are not affected.

Blocking the strictly-necessary session cookie in your browser will prevent sign-in from working. That is a limitation of how sessions work, not a choice we make.

If we add a cookie or a tracker, we will update this page and the consent version before it loads, so a previously-given consent is never silently reused for something new.

Questions: support@cloveai.app.

Last updated: 11 October 2026.