Legal

Cookie Notice

Last updated 2 October 2026

What Smart Tax Digital stores on your device, why, and for how long. The short answer: only what’s needed for the service to work — no analytics, no advertising.

1. What this notice covers

This notice explains the cookies and similar technologies used on smarttaxdigital.com — our public website and the Smart Tax Digital app — by Smart Tax Digital Ltd, headquartered in Exeter, United Kingdom. Read it alongside our Privacy Policy.

2. Cookies and similar technologies

A cookie is a small file a website saves in your browser so it can recognise you, or remember something, next time. Websites can also save information in your browser in other ways — local storage, session storage and IndexedDB. The UK rules on cookies apply to all of these, and so does this notice.

First-party means set by the website you’re on; third-party means set by another company’s service on that site.
Session items disappear when you close your browser; persistent ones stay for a set time or until you delete them.

3. The short version

Browsing our public website stores nothing on your device — unless you choose light or dark mode, which we remember for you.
When you sign in and use the app, we store only what’s needed for it to work: keeping you signed in, protecting your account, and the device identifier HMRC requires by law.
We use no analytics, advertising, tracking pixels or social-media tracking — none at all.
Because everything we use is strictly necessary or something you asked for, we don’t need to ask for your consent, so there’s no cookie banner.

4. Everything we store on your device

This is the complete list, all first-party and set on smarttaxdigital.com. It was last checked by an automated scan on 2 October 2026.

Name	Type	When it’s set	What it’s for and what it holds	How long	Category
`__session`	Cookie (secure, not readable by scripts)	When you sign in	Keeps you signed in. Holds a signed sign-in token linked to your account.	14 days, or until you sign out	Strictly necessary
`hmrc_oauth_state`	Cookie (secure, not readable by scripts)	When you connect to HMRC	Protects the HMRC connection from being hijacked (cross-site request forgery). Holds a random, signed value.	10 minutes	Strictly necessary
`fph_device_id`	Cookie (secure, not readable by scripts)	The first time the app contacts HMRC for you	The device identifier HMRC requires in fraud prevention data with every request. Holds a random ID, sent to HMRC.	400 days, renewed each time you use HMRC features	Strictly necessary (legal requirement)
`__acting_as`	Cookie (secure, not readable by scripts)	Only when an invited accountant opens a client’s account	Remembers which client’s account the accountant is viewing. Holds that account’s ID.	12 hours, or until they switch back	Strictly necessary
`firebaseLocalStorageDb`	IndexedDB (written by Google Firebase)	On the sign-in pages and in the app	Keeps your sign-in working in this browser. Holds your account ID, email address and sign-in tokens.	Until you sign out	Strictly necessary
`firebase-heartbeat-database`	IndexedDB (written by Google Firebase)	On the sign-in pages and in the app	Part of Google’s sign-in software. Records which versions of that software ran on which days, sent to Google with sign-in requests. Holds no account or personal details.	Persistent — cleared if you clear site data	Strictly necessary (part of the sign-in service)
`theme`	Local storage	Only when you choose light or dark mode	Remembers your choice. Holds “light”, “dark” or “system”.	Until you clear it	Preference you asked for

All of our cookies use SameSite=Lax, so other websites can’t use them to act as you. In the live service they’re also marked Secure, so they’re only ever sent over an encrypted connection.

5. What kinds we use

Category	Do we use it?	Consent needed?
Strictly necessary — sign-in, security, legally required fraud prevention data	Yes	No — exempt under the UK rules
Preferences — remembering a choice you made	Yes — light or dark mode only	No — it’s set only when you ask for it
Analytics and performance	No	Would be required
Marketing and advertising	No	Would be required

6. Other companies’ services

We don’t embed videos, maps, chat widgets, social-media content or other third-party content. Three services from other companies appear while you use Smart Tax Digital, and set their own cookies under their own policies:

Google sign-in — if you choose “Continue with Google”, Google’s sign-in window sets Google’s cookies. See how Google uses cookies.
HMRC — when you connect to HMRC, you sign in on HMRC’s own website, which sets HMRC’s cookies. See HMRC’s cookie page.
Square — the card form on our payment page comes from Square, which may set cookies to keep payments secure and prevent fraud. See Square’s cookie policy.

7. Why there’s no cookie banner

UK law (the Privacy and Electronic Communications Regulations) requires a website to ask before storing anything on your device — unless it’s strictly necessary to provide a service you’ve asked for. Everything listed above meets that test, or is a preference you’ve set yourself, so there’s nothing to ask permission for. The Information Commissioner’s Office explains these rules.

If we ever want to use analytics or any other non-essential technology, we’ll ask first — with a clear choice to accept or reject, no non-essential cookies set before you choose, and a permanent “Cookie settings” link in our footer to change your mind. We’ll update this notice before that happens.

8. Controlling cookies in your browser

Your browser lets you see, delete and block cookies and other site data, usually under Settings → Privacy. You can delete everything we’ve stored at any time.

If you block or delete our cookies, you’ll be signed out and won’t be able to sign in again until you allow them. Deleting fph_device_id means your device gets a new identifier, which HMRC will see as a new device.

9. Cookies and your personal data

Some of these items identify you or your device — for example the sign-in token and the device identifier sent to HMRC — so they count as personal data. We handle that data as described in our Privacy Policy, including your rights over it.

10. How these protect you

The sign-in cookie can’t be read by scripts on the page, which protects it from being stolen through a malicious script.
The HMRC connection cookie stops another website from secretly connecting your account to HMRC.
The device identifier is part of the data HMRC uses to spot criminals using someone else’s identity.

11. Where the data goes

The device identifier goes only to HMRC, in the UK. Sign-in data is handled by Google Firebase, which may process it outside the UK under the safeguards described in our Privacy Policy. Google, HMRC and Square handle their own cookies under their own policies, linked above.

12. Keeping this list accurate

We check what Smart Tax Digital stores with an automated scan in Google Chrome that loads our public pages as a logged-out visitor and the app as a signed-in user, and flags anything not listed here. We run it before any release that adds or changes third-party software, and at least every six months. The last scan was on 2 October 2026.

13. Changes to this notice

We’ll update this page whenever what we store changes, and revise the date at the top. If we ever add anything that needs your consent, we’ll ask for it before setting it.

14. Contact us

Questions about cookies or this notice: privacy@smarttaxdigital.com.