Most cookies the app uses are strictly necessary for it to function -- under the GDPR/ePrivacy directive those don't require visitor consent. One category (Google Analytics) is optional and only runs with your consent.
Necessary cookies
- Login (Supabase Auth) — maintains your logged-in session. Without this cookie you would have to log in on every visit to the site.
- Bot protection (Cloudflare Turnstile) — set only on the login, sign-up, and password reset pages, so the app can distinguish a real user from automated spam.
- Cookie consent choice — remembers whether you accepted or rejected Google Analytics, so the app doesn't ask again on every visit.
Optional cookies (consent-based)
- Google Analytics — measures traffic and app usage. The script doesn't load and no cookie is set at all until you actively click "Accept" in the banner on your first visit. You can change your choice anytime via "Cookie settings" in the page footer.
The app also uses Vercel Analytics to count page views — this service is cookieless and does not store any identifier in your browser.