Cookie and local-storage overview

Supabase authentication uses browser cookies or equivalent browser storage to establish and refresh a signed-in session. These values are necessary for login, account security, authorization, and session continuity. Disabling them can prevent authenticated parts of the service from working.

The theme control stores the selected light, dark, or system appearance locally. Locale routing can retain or infer the selected language so links and pages continue in the chosen locale. These preferences do not create an advertising profile.

Signature and public-profile analytics are recorded as server-side events rather than third-party advertising cookies. Collection depends on workspace settings, can honor the browser Do Not Track and Global Privacy Control signals, and uses configurable retention. Abuse controls can store a one-way hash derived from an IP address rather than the raw address.

When a user chooses Google or Microsoft sign-in, opens Stripe checkout or the billing portal, or follows another provider-hosted flow, that provider can set its own cookies on its domain. Its notice governs those provider-side values.

Browser settings can inspect or remove cookies and local storage. Removing essential session data signs the user out; removing preference storage resets appearance or locale choices. No cookie banner is shown by the current application because its own public pages do not install optional advertising or cross-site marketing cookies. This must be reassessed whenever production telemetry or marketing tools change.