Cookies and browser storage

Essential storage

Where account forms use Cloudflare Turnstile, the browser loads its security-check script and communicates with Cloudflare. This is limited to protecting the requested authentication or recovery function. Dashpop does not enable Turnstile pre-clearance cookies or use the check for advertising or audience analytics. See the Privacy policy for the network and browser information involved.

Supabase authentication uses sb-…-auth-token cookies (which may be split into numbered chunks) and a temporary code-verifier cookie for sign-in. They maintain and renew your requested session and complete authentication. Their lifetime is set by the authentication configuration; signing out clears the active session cookies. These are not advertising identifiers.

The HttpOnly shell_github_setup cookie links the GitHub setup flow you request to your account. It expires after 15 minutes or is removed when setup completes. It is not used for cross-site tracking.

Session storage holds dashpop.builder-return for your return destination and dashpop-order:… identifiers so a purchase retry does not create a duplicate order. Browser session storage normally ends when the tab closes. The Builder remembers your selected project under dashpop.active-project.v1 in local storage so you can resume it; it remains until replaced or browser data is cleared.

The service worker caches first-party application assets and an offline page to deliver the app experience. Browser caches persist until evicted, updated or cleared. Fonts are bundled locally. Dashpop stores no notice preference: because there is nothing optional to consent to, the storage information is published on this page and in the disclosure in the footer of every public page rather than recorded as a choice.

Choices and legal basis

Storage strictly necessary to provide a digital service you expressly request is used under § 25(2) no. 2 TDDDG. Processing of personal data additionally requires the bases explained in the Privacy policy. Optional analytics, advertising or other non-essential storage would require a separate prior, freely given choice under § 25(1) TDDDG; none is enabled.

Open “Cookies & storage” in any public footer to read a summary without leaving the page. You can remove stored data through your browser settings, sign out to end your authenticated session, or disable browser storage. Removing necessary data may sign you out or interrupt requested features. There are currently no optional tracking categories to accept or reject.

Stripe-hosted checkout and GitHub have their own notices for their websites. Following an external link or starting one of those features sends a request to that provider. This page describes Dashpop’s own storage, not every third-party website or independently published game.