Last updated: October 2, 2026

Cookie Policy

This Cookie Policy explains how Barrion AB (organisation number 559569-0917, Sweden) ("Barrion," "we," "us") uses cookies and similar technologies on barrion.io, including the signed-in Barrion app. It lists what we store in your browser, who sets it, why, and for how long, and explains how you can accept, reject or change your choice.

Some of this information can be personal data. Our Privacy Policy explains how we handle personal data and your rights. The service providers that process data for us are listed on our Trust page.

What are cookies and similar technologies?

Cookies are small text files that a website stores in your browser. Websites can also store data in your browser's local storage, session storage and IndexedDB. This policy covers all of them, and we use the word "cookies" for all of them where the difference does not matter.

First-party cookies are set by the site you are visiting. Third-party cookies are set by another company's service used on that site. Session storage is deleted when you close the tab. Other cookies and storage stay until they expire or you delete them.

How consent works on barrion.io

On your first visit a consent banner from CookieYes appears with three buttons: "Accept All", "Reject All" and "Customise". "Customise" lets you switch on or off each category: Functional, Analytics, Performance and Advertisement. Necessary cookies are always on. Your choice is saved in the cookieyes-consent cookie for one year and passed to Google (through Google Consent Mode) and to PostHog.

Before you choose, or if you reject: Google Tag Manager loads to show the consent banner, but Google Analytics and PostHog are not started. They send nothing and store nothing in your browser.

If you accept Analytics: Google Analytics sets the _ga cookies below, and PostHog starts, stores the identifiers listed below and records how the site is used, such as page views and clicks. PostHog can also record sessions. These recordings are fully masked, so all text and form fields are hidden and what you type is not captured.

If you accept Advertisement: we do not show ads on barrion.io and do not set advertising cookies. Accepting this category allows Google Analytics to share measurement data with Google's advertising services (Google signals). Leave it off if you do not want that.

Functional and Performance: we do not currently use any third-party cookies in these categories. Our own functional storage is listed below.

Strictly necessary

These are needed for the site and app to work, for example to remember your consent choice and to keep you signed in. They are always on and cannot be switched off in the banner.

cookieyes-consent

Provider:: Barrion (set by CookieYes)
Purpose:: Cookie. Remembers which cookie categories you accepted or rejected.
Duration:: 1 year

sessionToken

Provider:: Barrion
Purpose:: Cookie and local storage. Keeps you signed in and lets us check that you may open the dashboard. Only set after you sign in.
Duration:: Cookie: 7 days (30 days after email verification). Local storage: until you sign out

bx_billed_ccy

Provider:: Barrion
Purpose:: Cookie. Remembers the currency your paid plan is billed in (USD or EUR), so prices show in that currency from the first moment a page loads. Only set for signed-in accounts on a paid plan. It does not decide what you are charged.
Duration:: 1 year, or until you sign out

auth-storage, user

Provider:: Barrion
Purpose:: Local storage. Holds your signed-in state and basic account details for the app.
Duration:: Until you sign out

activeOrganizationId

Provider:: Barrion
Purpose:: Local storage. Remembers which organisation you are working in.
Duration:: Until you sign out or clear it

firebaseLocalStorageDb

Provider:: Google (Firebase Authentication)
Purpose:: IndexedDB. Used when you sign in with Google or Microsoft to complete the sign-in. Not set if you sign in with email.
Duration:: Until you clear it

guestAccessToken, guestScanId, pendingGuestScanId

Provider:: Barrion
Purpose:: Local and session storage. Lets you open the results of a free scan you ran without an account, and attach it to your account if you sign up.
Duration:: Until you clear it (session storage: until you close the tab)

postAuthRedirect, pendingInvitationToken, mcp_authorize_resumed

Provider:: Barrion
Purpose:: Local and session storage. Returns you to the right page after sign-in, and completes a team invitation or an MCP authorisation you started.
Duration:: Until the step completes or you close the tab

Name	Provider	Purpose	Duration
`cookieyes-consent`	Barrion (set by CookieYes)	Cookie. Remembers which cookie categories you accepted or rejected.	1 year
`sessionToken`	Barrion	Cookie and local storage. Keeps you signed in and lets us check that you may open the dashboard. Only set after you sign in.	Cookie: 7 days (30 days after email verification). Local storage: until you sign out
`bx_billed_ccy`	Barrion	Cookie. Remembers the currency your paid plan is billed in (USD or EUR), so prices show in that currency from the first moment a page loads. Only set for signed-in accounts on a paid plan. It does not decide what you are charged.	1 year, or until you sign out
`auth-storage, user`	Barrion	Local storage. Holds your signed-in state and basic account details for the app.	Until you sign out
`activeOrganizationId`	Barrion	Local storage. Remembers which organisation you are working in.	Until you sign out or clear it
`firebaseLocalStorageDb`	Google (Firebase Authentication)	IndexedDB. Used when you sign in with Google or Microsoft to complete the sign-in. Not set if you sign in with email.	Until you clear it
`guestAccessToken, guestScanId, pendingGuestScanId`	Barrion	Local and session storage. Lets you open the results of a free scan you ran without an account, and attach it to your account if you sign up.	Until you clear it (session storage: until you close the tab)
`postAuthRedirect, pendingInvitationToken, mcp_authorize_resumed`	Barrion	Local and session storage. Returns you to the right page after sign-in, and completes a team invitation or an MCP authorisation you started.	Until the step completes or you close the tab

Functional storage

Our own code stores these in your browser to remember settings and to make features you use work. They are not set by third parties.

barrion_visitor_currency_v2

Provider:: Barrion
Purpose:: Session and local storage. Remembers whether to show prices in USD or EUR, based on your browser language or approximate location. Without Functional consent it is kept in session storage for your current visit only. It is remembered across visits in local storage only if you accept Functional cookies, and removed from there if you withdraw that consent.
Duration:: Until you close the tab (local storage, with consent: until you clear it)

bx_ccy

Provider:: Barrion
Purpose:: Cookie. Remembers the same USD or EUR choice, so prices show in your currency from the first moment a page loads on your next visit. Only set once your currency is known and only if you accept Functional cookies. It does not decide what you are charged.
Duration:: 1 year

theme

Provider:: Barrion
Purpose:: Local storage. Remembers light or dark mode. Only set if you change it.
Duration:: Until you clear it

referralCode

Provider:: Barrion
Purpose:: Local storage. Remembers a referral code from a link you followed, so it can be applied when you sign up.
Duration:: Until you sign up or clear it

utmParams

Provider:: Barrion
Purpose:: Local storage. Remembers the campaign tags (utm_ parameters) of the link you arrived from, so we can see which campaign led to a sign-up. Only set if the link had such tags.
Duration:: Until you clear it

Dismissed notices and drafts

Provider:: Barrion
Purpose:: Local and session storage in the app. Remembers banners you closed, collapsed panels, and unsaved setup drafts so you do not lose work.
Duration:: Until you clear it (session storage: until you close the tab)

Name	Provider	Purpose	Duration
`barrion_visitor_currency_v2`	Barrion	Session and local storage. Remembers whether to show prices in USD or EUR, based on your browser language or approximate location. Without Functional consent it is kept in session storage for your current visit only. It is remembered across visits in local storage only if you accept Functional cookies, and removed from there if you withdraw that consent.	Until you close the tab (local storage, with consent: until you clear it)
`bx_ccy`	Barrion	Cookie. Remembers the same USD or EUR choice, so prices show in your currency from the first moment a page loads on your next visit. Only set once your currency is known and only if you accept Functional cookies. It does not decide what you are charged.	1 year
`theme`	Barrion	Local storage. Remembers light or dark mode. Only set if you change it.	Until you clear it
`referralCode`	Barrion	Local storage. Remembers a referral code from a link you followed, so it can be applied when you sign up.	Until you sign up or clear it
`utmParams`	Barrion	Local storage. Remembers the campaign tags (utm_ parameters) of the link you arrived from, so we can see which campaign led to a sign-up. Only set if the link had such tags.	Until you clear it
`Dismissed notices and drafts`	Barrion	Local and session storage in the app. Remembers banners you closed, collapsed panels, and unsaved setup drafts so you do not lose work.	Until you clear it (session storage: until you close the tab)

Analytics

We use Google Analytics (loaded through Google Tag Manager) and PostHog to understand how visitors use barrion.io and the app, so we can fix problems and improve it. PostHog is hosted in the EU and loads through our own domain.

_ga

Provider:: Google Analytics
Purpose:: Cookie. Distinguishes visitors so we can count visits and see how the site is used. Only set after you accept analytics.
Duration:: 400 days

_ga_RFQBXC42YN

Provider:: Google Analytics
Purpose:: Cookie. Keeps the state of your current visit for our Google Analytics property. Only set after you accept analytics.
Duration:: 400 days

ph_<project key>_posthog

Provider:: PostHog
Purpose:: Cookie and local storage. Holds a pseudonymous device and session identifier. If you are signed in, it is linked to your account. Only set after you accept analytics.
Duration:: Cookie: 1 year. Local storage: until you clear it

ph_<project key>_window_id, ph_<project key>_primary_window_exists, ph_<project key>_posthog

Provider:: PostHog
Purpose:: Session storage. Tracks the current browser tab for the same session. Only set after you accept analytics.
Duration:: Until you close the tab

__ph_opt_in_out_<project key>

Provider:: PostHog
Purpose:: Local storage. Records that you accepted analytics, so PostHog stays switched on.
Duration:: Until you clear it

Name	Provider	Purpose	Duration
`_ga`	Google Analytics	Cookie. Distinguishes visitors so we can count visits and see how the site is used. Only set after you accept analytics.	400 days
`_ga_RFQBXC42YN`	Google Analytics	Cookie. Keeps the state of your current visit for our Google Analytics property. Only set after you accept analytics.	400 days
`ph_<project key>_posthog`	PostHog	Cookie and local storage. Holds a pseudonymous device and session identifier. If you are signed in, it is linked to your account. Only set after you accept analytics.	Cookie: 1 year. Local storage: until you clear it
`ph_<project key>_window_id, ph_<project key>_primary_window_exists, ph_<project key>_posthog`	PostHog	Session storage. Tracks the current browser tab for the same session. Only set after you accept analytics.	Until you close the tab
`__ph_opt_in_out_<project key>`	PostHog	Local storage. Records that you accepted analytics, so PostHog stays switched on.	Until you clear it

How can I change or withdraw my consent?

You can change your choice at any time with the "Consent Preferences" button in the bottom-left corner of every page on barrion.io. Withdrawing consent stops further collection from that point. It does not affect data collected before you withdrew it. To remove cookies that are already stored, delete them in your browser.

You can also block or delete cookies in your browser settings. If you block necessary cookies or storage, you will not be able to sign in. These pages explain how to manage cookies in the most common browsers:

Changes to this policy

We update this policy when the cookies or tools we use change. The date at the top shows when it was last updated.

Contact

If you have questions about how we use cookies, email us at legal@barrion.io. Barrion AB, organisation number 559569-0917, Sweden.