Authentication
Supabase SSR uses project-scoped authentication cookies, potentially split into chunks, to maintain and refresh a session. The installed SSR library defaults to a 400-day cookie maximum age; token validity and server session settings are separate. Cookies use SameSite=Lax and the application enables Secure in production. Actual session duration and project policies must be confirmed by the operator. These are needed for signed-in features.
Day and Midnight
The sterling-world cookie remembers your chosen visual world. The application sets Path=/, SameSite=Lax, a maximum age of 31,536,000 seconds (one year), and Secure on HTTPS. It contains the theme selection, not a user identifier.
Existing Web Analytics
The root layout enables @vercel/analytics only in production. Vercel describes Web Analytics as cookie-free and using a daily discarded hash for visitor/session measurement. The installed integration is retained; this release adds no analytics tracker. Confirm the live dashboard settings, data processing terms and whether the actual setup qualifies for any applicable consent exemption. Cookie-free does not mean privacy-free.
Other browser storage
No application-authored localStorage or sessionStorage use was found in the current source audit. Supabase client libraries and hosting infrastructure may manage supporting authentication state. No advertising-cookie integration was found. External sites you visit through source links may use their own cookies.
Your controls
Browser settings can inspect or remove cookies; removing authentication cookies can sign you out, and removing the theme cookie resets that preference. No decorative consent banner is presented as a substitute for a valid consent mechanism. If non-exempt optional tracking is introduced or discovered, it must be blocked until the required choice is implemented.