Cookie Policy
Storage inventory, optional-service controls and how to change your choices.
Categories
Strictly necessary: authentication, request security and remembering privacy choices. Preferences: optional convenience settings, none currently separately persisted by TapsMaps. Analytics: optional product measurement, no app-level analytics SDK currently integrated. Functional: optional interactive Mapbox map and related SDK storage/requests. Marketing/advertising: future advertising tracking, currently no integration and disabled unless permitted; GPC always forces it off.
Observed storage inventory
The versioned inventory below describes names and durations found in app/installed SDK code. It is not a claim that every entry is set on every visit. Provider-side durations and infrastructure cookies require deployment scanning. Auth storage is necessary and independent of optional choices.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| tapsmaps-venue-suggestion-dismissed | TapsMaps | Strictly necessary | Remember an optional venue-banner dismissal in this tab session; contains only a boolean, no account/auth token | Current browser tab session (sessionStorage) |
| sb-<project-ref>-auth-token (including numbered chunks) | Supabase SSR | Strictly necessary | Cookie-based access/refresh session; not localStorage | SDK cookie maxAge: 400 days; token expiry, refresh and server revocation can end access sooner |
| sb-<project-ref>-auth-token-code-verifier | Supabase SSR | Strictly necessary | Temporary PKCE authentication/recovery verification; removed by the completed auth flow | Temporary auth flow; SDK cookie default maxAge may otherwise apply |
| tapsmaps-consent | TapsMaps | Strictly necessary | Versioned optional-category choices and timestamp; no unique identifier | 180 days; invalidated on consent-version change |
| mapbox.eventData* (including uuid and uuidTimestamp variants) | Mapbox GL JS | Functional | Map SDK event/session localStorage, gated with the interactive map | SDK rotates anonymous UUID after about 24 hours; localStorage has no automatic browser expiry; removed on functional-consent withdrawal |
| tapsmaps-dev-admin / tapsmaps-dev-claim | TapsMaps development only | Strictly necessary (development only) | Explicit local test sessions, disabled in production | 4 hours or earlier process/session expiry |
Consent and withdrawal
Non-essential categories default off worldwide. Accept All and Reject Non-Essential have equal prominence; Manage Preferences exposes individual choices. Reopen Privacy Choices at any time to save changes or withdraw consent. The consent cookie stores only version, category booleans, choice timestamp and a global-opt-in mode, without a consent identifier or location. It expires after 180 days; expired, malformed or obsolete records are treated as no consent. Blocking browser storage may mean choices do not persist; optional services then remain off.
Browser and Sec-GPC Global Privacy Control signals force advertising off, including after an earlier opt-in. Functional map permission is separate from optional analytics and from device geolocation permission. Withdrawing map consent removes the map instance and Mapbox storage created by the SDK; requests already completed cannot be undone. Necessary auth cookies are not removed by rejecting optional categories.
Browser controls and future providers
You can delete cookies/storage in browser settings; deleting necessary authentication cookies signs you out. Cookie choices apply to this browser and are not automatically synchronized across devices. Before adding analytics, advertising, embeds or new providers, update the inventory and policy and integrate their startup, teardown and stored-identifier cleanup with the consent gate. No cookie wall blocks core venue browsing.
Contact / legal inquiries · Exercise privacy rights · Your Privacy Choices