The cookies
- Supabase session (sb-…-auth-token)
- Set when you sign in and keeps you signed in. Without it every page would ask you to sign in again. First-party, expires when the session does. Strictly necessary.
- lang
- Remembers whether you chose English or German, so the server can render the page in the right language on the first request rather than flashing the wrong one. First-party, one year. Strictly necessary for the preference you set.
What is not here
No analytics cookies. No advertising or retargeting pixels. No social media buttons that phone home. No session recording, heat maps or fingerprinting. No cross-site tracking. No third-party cookies of any kind.
Marketing emails sent through the product may record that a message was opened or a link clicked, so that the business following up knows whether their message landed. That happens in email, not in your browser, and the business sending it controls whether it is used at all.
Refusing them
Your browser can block or delete cookies at any time. Blocking the session cookie means you cannot stay signed in; blocking the language cookie means the site follows your browser’s language setting instead. Nothing else changes, because nothing else depends on one.