Cookies

We only set cookies that are strictly necessary to deliver the service you have asked for. Under the ePrivacy Directive (Art. 5(3)) and Recital 66, such cookies do not require prior consent, which is why we do not show a cookie banner.

Authentication and session — set by our authentication provider, Supabase. They keep you signed in and tie your browser to your account.

• sb-<project>-auth-token — encrypted session token. Lifetime: rotates hourly with a 30-day refresh token. Set by Supabase, first-party.
• sb-<project>-auth-token-code-verifier — PKCE verifier used during the OAuth / magic-link sign-in flow. Lifetime: a few minutes; deleted as soon as the flow completes.

Browser local storage may also be used by the same authentication library to cache the current session client-side. It is not strictly a cookie but is covered by the same essential-purpose rules.

• No advertising or marketing cookies.
• No third-party tracking cookies.
• No cross-site behavioural advertising; we do not sell or "share" data with ad networks.
• No analytics that fingerprint users. Our traffic measurement runs on Vercel Analytics, which is cookieless and does not build cross-site identifiers.