Cookie Policy

1. What are cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work, to keep you signed in, and to remember your preferences. Cookies set by the site you are visiting are called first-party cookies; cookies set by another domain are third-party cookies. Cookies that last only for your current browser session are session cookies; those that remain until they expire or are deleted are persistent cookies.

2. How we use cookies

We keep cookies to a minimum. We use them only to sign you in and to remember a small amount of session state. We do not use any advertising, marketing, or analytics/tracking cookies, and we do not sell your data. The cookies we set fall into two categories:

• Strictly necessary — required for the Service to function (e.g. keeping you signed in). These cannot be switched off without breaking core features such as login.
• Functional — remember a choice you made (e.g. browsing as a guest) to improve your experience.

3. Cookies we set (first-party)

• sb-…-auth-token — Keeps you securely signed in by storing your authentication session (issued by our authentication provider, Supabase). Without it you would be signed out on every page. Strictly necessary; persistent — lasts for the session's refresh-token lifetime; removed when you log out.
• gum_guest_mode — Remembers that you chose to browse as a guest (without an account) so the app shows the correct guest experience. Functional; lasts 24 hours; removed when you sign in or sign up.

For technical reasons the authentication cookie above may appear in your browser as several related entries — e.g. sb-…-auth-token.0, sb-…-auth-token.1 (the session split across multiple cookies when it is large), and a short-lived sb-…-auth-token-code-verifier created only during a “Continue with Apple/Google” sign-in and discarded immediately after. These are all part of the same strictly-necessary sign-in function.

4. Third-party cookies

When you choose to sign in with Apple or Google, those providers set their own cookies on their own domains (appleid.apple.com, accounts.google.com) to carry out the sign-in. We do not set, read, or control these cookies; they are governed by Apple's and Google's respective privacy and cookie policies. We do not embed third-party advertising or analytics that set cookies.

5. Similar technologies (not cookies)

For transparency, the Service also uses a small amount of browser storage that is technically not a cookie:

• Session storage — remembers, for the current tab only, that you dismissed an in-app banner. Cleared when the tab closes.
• IndexedDB — an optional, off-by-default mode that can store your sign-in session locally instead of in the authentication cookie.

6. Managing or disabling cookies

You can control and delete cookies through your browser settings, and set your browser to block them. Please note that our strictly-necessary cookie is required to sign in — if you block it, you will not be able to log in or use account features. Guidance for common browsers:

• Safari: Settings → Safari → Advanced → Website Data.
• Chrome: Settings → Privacy and security → Cookies and other site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.

You can also sign out at any time within the app, which removes the authentication cookie from your device.

7. Changes to this policy

We may update this Cookie Policy from time to time to reflect changes to the cookies we use or for operational, legal, or regulatory reasons. We will revise the “Last updated” date above when we do.

8. Contact us

If you have any questions about our use of cookies, please email us at contact@passthatgum.com.