1. Scope
This policy covers first-party web cookies, browser storage and mobile WebView storage used by Anthony Stilo. Provider websites opened in a new browser context set their own technologies under their policies.
Version [LEGAL:policy-version-pending] · effective date [LEGAL:effective-date-pending]
STORAGE SHOULD HAVE A REASON.
This inventory distinguishes necessary account and security storage from analytics or advertising that the reviewed source does not currently contain.
- Auth storage is necessary
- Turnstile is route-specific
- No generic analytics found in source
Version [LEGAL:policy-version-pending] · effective date [LEGAL:effective-date-pending]
COOKIE AND LOCAL-STORAGE POLICY.
Cookies are small browser values. The website and app can also use browser or device storage with similar practical effects. The final production domain and signed app artefacts must be scanned before this inventory is published as final.
2. Current reviewed inventory
The 1 August 2026 source review found Supabase authentication storage, a route-specific Cloudflare Turnstile widget, and mobile local storage for language and a random per-install notification identifier. It found no advertising pixel or general-purpose analytics SDK. Hosting headers, production tag injection, provider dashboards and final signed mobile artefacts remain to be audited.
3. Authentication cookies
When account access is configured, Supabase SSR uses first-party browser-readable cookies for PKCE/session material and token refresh. They are marked Secure in production and SameSite=Lax in the reviewed configuration. They are necessary to sign in, keep the requested session and protect authenticated routes; exact cookie names, lifetimes and logout behaviour must be captured from the production project.
4. Form-abuse protection
The private-request page can load Cloudflare Turnstile when configured. The browser runs Cloudflare code and the server sends the resulting token and, where available, the request IP to Siteverify to distinguish legitimate submissions from abuse. Cloudflare may process browser, network and challenge signals. Whether a clearance cookie is enabled and the contractual retention must be verified in the production widget settings.
5. Local and device storage
The mobile app stores the selected language and a random installation nonce locally. Supabase can also persist the app session on the device. The nonce supports registration or revocation of an optional push token; it is not presented as an advertising identifier. Clearing app data or uninstalling can remove local values but does not by itself delete server records.
6. Analytics and advertising
No generic analytics, advertising SDK, ad display, cross-company tracking or profiling cookie was observed in the reviewed code. This is a scoped technical finding, not a permanent promise. If any non-essential analytics, personalisation or advertising technology is added, this policy, consent interface and store disclosures must be updated before it loads.
7. Consent and controls
Necessary authentication and security storage does not use the same consent rule as optional tracking. If optional technology is introduced, it must remain blocked until a valid choice, offer reject and accept with comparable prominence, allow granular control, record the choice, and make withdrawal as easy as consent. Browser settings can delete or block storage, but doing so may break sign-in or the protected form.
8. Third parties
Relevant observed services are Supabase and Cloudflare; Google or Apple may set storage when the user actively chooses their OAuth flow, and Booksy applies its own policy after an external click. OpenAI processes Concierge requests server-side and is not loaded as a browser cookie script in the reviewed implementation. Supplier roles and retention remain subject to the approved register.
9. Changes and contact
Inventory changes will be versioned. Questions or a mismatch between this policy and what your browser shows can be sent to [LEGAL:privacy-contact-pending]. The cookie audit status for this version is pending; production remains blocked while that status is pending.
Related information
STORAGE IS ONLY ONE PART OF PRIVACY.
See the full data-flow, supplier and retention explanation.
