Draft for legal review — not yet in effect.
This is a working draft (v0.1-draft) prepared for review by counsel during the private beta. Placeholders in [brackets] are not yet decided.
Cookie Notice
Effective date: [EFFECTIVE DATE]
This notice covers `mrrloop.net` (public site) and `app.mrrloop.net` (the MRRLoop app, private beta). MRRLoop uses only what it needs to work. We do not use advertising or cross-site tracking cookies, and we load no third-party analytics scripts.
What we use
| Name | Set by | Where | Purpose | Lifetime |
|---|---|---|---|---|
| `sb-<project>-auth-token` (may be split into `sb-<project>-auth-token.0`, `.1`, …) | Supabase Auth, through our app | `app.mrrloop.net` | Keeps you signed in (your session). Essential. | Session token lifetime; refreshed while you use the app; removed on sign-out |
| `sb-<project>-auth-token-code-verifier` | Supabase Auth, through our app | `app.mrrloop.net` | Protects the magic-link sign-in (one-time code verifier, PKCE). Essential. | Minutes, removed after sign-in |
| `mrrloop-theme` (local storage, not a cookie) | Our app | `app.mrrloop.net`, `mrrloop.net` | Remembers your light/dark choice. Never sent to us. | Until you clear it |
| `mrrloop-sidebar` (local storage, not a cookie) | Our app | `app.mrrloop.net` | Remembers whether the sidebar is collapsed. Never sent to us. | Until you clear it |
| `_vercel_jwt` and related `_vercel_*` cookies | Vercel (our host) | `app.mrrloop.net` | Only while the private beta is behind Vercel's access protection: proves you passed the access gate (Vercel Authentication, Password Protection or an automation bypass). Essential during the beta. | Set by Vercel; removed when protection is turned off or you clear cookies |
| Cloudflare Turnstile | Cloudflare | sign-in page (`app.mrrloop.net`), loaded from `challenges.cloudflare.com` | Bot protection on sign-in. Turnstile processes technical signals about your browser for this purpose. [TBD — confirm whether Turnstile sets cookies or similar storage in the configured (managed/non-interactive) mode, and its retention.] | [TBD] |
`<project>` is the identifier of our database provider project. If we use app-layer Basic Authentication as the access gate instead of Vercel's, your browser remembers the credentials for the session; no cookie is set by us for that.
First-party product analytics. We record in-app events (for example "plan accepted") in our own database, tied to your account, without cookies beyond the sign-in cookie above. Reports our team sees are aggregated, and groups smaller than 5 members are hidden.
Error monitoring (Sentry, EU region, once enabled). Error reports are sent from our servers and, for browser errors, from the app itself; they are scrubbed (no cookies, auth headers, emails, IP addresses or amounts) and set no cookies.
Your choices
You can clear cookies and local storage in your browser at any time; you will be signed out. Because we only use essential cookies and storage, we do not show a consent banner. [TBD — counsel to confirm this is sufficient under the EU ePrivacy rules, UK PECR and other applicable law, including for Turnstile and for first-party analytics linked to accounts.]
Questions: [CONTACT EMAIL — e.g. hello@mrrloop.net].