1. What cookies and similar technologies are
Cookies are small text files stored by a website in a browser. Similar browser storage, such as localStorage, can keep a small value on the device between page visits. Stampah uses these technologies only for functions described below. The current application has no cookie banner or preference centre because no optional tracker has been found.
2. Current inventory
The names below are based on the application code and the installed Supabase SSR/Auth libraries. Supabase session names include the project reference and may be split into numbered cookie chunks when a session is large, so the table uses the deployment-safe name pattern rather than fabricating a fixed runtime value.
| Name/key | Provider | Type/category | Purpose | Expiry or duration | First or third party | Consent required? |
|---|---|---|---|---|---|---|
sb-<project-ref>-auth-token and numbered chunks such as .0 | Supabase SSR/Auth, set for Stampah | HTTP cookie; strictly necessary authentication | Maintains and refreshes signed-in merchant and staff sessions across requests. | Supabase SSR library default is up to 400 days; session validity and replacement can make the practical duration shorter. | First party on Stampah’s domain | No. It is necessary for the requested signed-in service. |
sb-<project-ref>-auth-token-flow-<flow-id>-code-verifier, its flow index and legacy verifier key where used | Supabase Auth via @supabase/ssr | HTTP cookie; strictly necessary authentication flow storage | Temporarily supports the PKCE sign-in, confirmation or recovery exchange. | Normally removed after the flow; the library applies its cookie storage defaults if it remains temporarily. | First party on Stampah’s domain | No. It is necessary to complete the requested authentication flow. |
stampah:join:<programme-token>:live or :test | Stampah | localStorage; strictly necessary, user-requested service storage | Stores a UUID idempotency key so a repeated join submission does not create duplicate loyalty records. | No fixed expiry is set by the application. It remains until browser storage is cleared or the key is replaced. | First party in the user’s browser | No. It supports the joining action the user requested. |
stampah:pwa-install-dismissed | Stampah | localStorage; functional preference | Remembers that a staff user explicitly dismissed the Add to Home Screen suggestion, so it does not repeatedly reappear. | No fixed expiry is set. It remains until browser storage is cleared. | First party in the user’s browser | No separate consent prompt is requested. The value records the user’s explicit dismissal and is not used to identify them or track activity. |
The code audit found no application use of sessionStorage, analytics scripts, advertising scripts, marketing pixels, web beacons, email-open tracking or a consent-management script. The install-dismissal value above is the only current preference key. Runtime provider configuration and browser extensions can add technologies outside the repository; those are not controlled by Stampah.
3. Strictly necessary technologies
Supabase authentication cookies are required for sign-in, session continuity, access control and security checks in merchant, staff and account areas. The first-party join key is required to protect the requested customer-join action against duplicate submissions. The public website, public joining pages and browser cards do not require a signed-in customer account cookie.
Blocking or deleting essential cookies can sign you out, prevent authentication from completing or stop protected features from working. Clearing the join key can make a later repeated submission use a new idempotency key; the database still applies its own join protections.
4. Optional technologies
Stampah does not currently set optional analytics, marketing or advertising cookies or similar storage. There is therefore no optional category to accept or reject and no misleading accept/reject banner is displayed. If optional technologies are introduced, Stampah will update this policy and implement prior consent, equal accept and reject choices, a persistent preference control and withdrawal handling before those technologies load where required by law.
5. Managing cookies and storage
You can restrict, delete or block cookies and localStorage through your browser controls. Browser help pages explain how to do this. Disabling essential storage may prevent sign-in, account recovery, protected business tools or reliable joining from working. Clearing the install-dismissal key can make the contextual install suggestion eligible to appear again.
Because there are no optional technologies at present, Stampah does not provide a separate cookie-preference centre. A future optional-cookie control will be linked from the footer before optional storage is enabled.
6. Contact and updates
Questions about cookies or browser storage can be sent to stampahsupport@gmail.com. See the Privacy Policy, Terms and Conditions and Support pages. We will update this policy if the technologies used by Stampah change.