Cookie policy
Last updated October 7, 2026 · Version 2026-10-07
Prelaunch notice: this site is for testing only and registration is closed. Do not enter real personal information. These policies describe the current application; operator details and operational retention procedures must be finalized before real-account registration opens.
What this site uses
The app currently uses only storage needed to sign you in and keep your session working. It does not implement analytics cookies, advertising pixels, session replay, fingerprinting, marketing tags, or third-party embeds. It does not store application profiles in browser localStorage or sessionStorage.
| Cookie | Purpose and provider | Duration |
|---|---|---|
| pb-session (demo) | First-party signed identifier for your fictional workspace and selected demo role. HttpOnly; SameSite=Lax; Secure in production. | 24 hours from demo sign-in or role switch; removed on sign-out. |
| sb-…-auth-token, including numbered chunks (live mode) | Supabase authentication session, set on the app’s domain. Supports sign-in and session refresh. May contain access/refresh tokens; do not disclose it. | The installed SSR library defaults to a 400-day cookie maximum age, refreshed with the session. Actual authentication validity depends on the provider’s session configuration; sign-out expires the app’s session cookies. |
| sb-…-auth-token-code-verifier (if an authentication flow uses PKCE) | Supabase proof-key verifier for completing a sign-in flow; only used if that flow is enabled. | Temporary flow data; cleared when consumed. An abandoned flow may persist for the configured cookie lifetime. |
Your choices
There are no optional tracking categories to accept. We do not show a misleading “accept all” banner for essential-only storage. You can browse the public pages without signing in. Blocking or clearing session cookies prevents or ends sign-in; use your browser’s cookie controls or Sign out. Clearing cookies does not erase server records.
Provider and development differences
Hosting/security providers may introduce additional necessary cookies depending on the deployment. Development tooling may also differ from a published site. The production cookie inventory must be rechecked before launch and when authentication or hosting changes. Supabase cookies are only relevant when live mode is configured; the current local demo uses pb-session.
Future tracking and contact
If optional analytics, marketing, or embeds are introduced, this policy and the controls must be updated before they load. Where permission is required, declining must be as easy as accepting, and optional code must stay off until a valid choice is made. At present, there is no sale or targeted-advertising sharing to opt out of. Questions: Privacy contact pending — real-account registration is not open..
Back to home