Cookies

Effective October 10, 2026.

tools.ltd sets only strictly necessary cookies. We do not set advertising or analytics cookies. Because of that, we do not show a cookie banner.

We use Cloudflare Web Analytics to count visits and see how fast pages load. It sets no cookies, it does not track you across other sites, and it never sees your files.

Checkout runs on Stripe’s site. Stripe may set its own cookies there. We do not control those cookies, and we do not copy them onto tools.ltd.

Cookies this site sets

Cookies set by tools.ltd
Name	Purpose	Lifetime
`ts_browser`	A random id for this browser, so free use can be counted. Sheetsnap: 1 free table a month. Ebook Medic: 1 free check a month. TrueRedact: 1 free page a month. PageKit: 1 free task a month. Plain Invoice: 1 free invoice a month. Mileage Log: 1 free log a month. Rent Check: 1 free rent check a month. JPG to PDF: 1 free file a month. PDF to Word: 1 free conversion a month. The same cookie is used for all of them; the counters are separate. MyBankToExcel does not use this cookie for a free download allowance. The cookie is HttpOnly, SameSite=Lax, and Path=/. It is marked Secure when the page is served over HTTPS. It is set when you call a free-allowance API (convert, usage, an Ebook Medic check, a TrueRedact page count, or a PageKit task count).	1 year (Max-Age 365 days).
`stmt_entitlement`	Set only after a paid MyBankToExcel Checkout is confirmed. It stores a signed Checkout session id so a later download can be authorized. It does not contain the bank statement. HttpOnly, SameSite=Lax, Path=/, and Secure on HTTPS.	30 days. The signature inside the cookie also expires after 30 days.
`ts_pro`	Set only after a paid Pro plan is confirmed with Stripe, or after you open an access link we emailed you. It holds a signed Stripe customer id, subscription id, and the tools the plan unlocks, so this device gets Pro. We re-check the subscription with Stripe, so a cancelled or unpaid plan stops working even if the cookie is still there. HttpOnly, SameSite=Lax, Path=/, and Secure on HTTPS.	400 days. The signature inside the cookie also expires after 400 days.
`ms_session`	A signed email for the developer dashboard. The public site does not set this cookie. Production has developer login off (`DEV_AUTH` is false). The code sets it only when developer login is turned on, from the dev-login route. HttpOnly, SameSite=Lax, Path=/. The code does not mark it Secure.	30 days (Max-Age 2592000) when it is set. Logout clears it.

Ebook Medic does not set its own cookie. The free check allowance uses ts_browser.

Not cookies

Theme: localStorage key tableshift-theme (light or dark). It is a preference you set. It is not a cookie and it is not sent to the server.
MyBankToExcel: sessionStorage keys stmt_blob, stmt_preview, and stmt_session. The sealed statement expires after 24 hours. sessionStorage clears when the tab closes. These are not cookies.
Ebook Medic: IndexedDB database epubfix, object store books, key current. It holds the EPUB so a paid download can be built without the server keeping the file. It is deleted after a paid download or once it is 24 hours old. It is not a cookie.

Questions: support@tools.ltd.