Cookies and tracking — draft

Inventory identified in code

The code contains Supabase/PKCE authentication, password recovery, BUSINESS referral and opportunity continuity cookies. Bookings and some reward actions use sessionStorage for idempotency; some booking fingerprints include notes. Browser-session lifetime is not server retention.

The code records Experience views/clicks and contacts that may be linked to accounts; they are not described as anonymous. E2 removes the remote Google Fonts CSS import locally and uses system fonts. GA/GTM/Meta pixels or advertising SDKs were not identified in reviewed source; this does not certify hosting or deployed runtime.

Observed technical lifetimes

SDK auth-cookie default: 400 days, not a guarantee of authenticated-session duration. Password recovery: 10 minutes. Referral failure marker: 7 days; referral context uses backend expiry. Opportunity: 30 days. SessionStorage keys: cleared on success where implemented, otherwise no application TTL identified. Deployed configuration must be verified.

Decisions before Beta

REQUIRED BEFORE BETA: classify necessity/consent for measurement and attribution; verify actual technologies/lifetimes, recipients and transfers. No decorative banner was added. This draft does not describe the site as “technical only” or offer non-working preferences. Where required, consent must precede activation and be granular and withdrawable.