1. Cookies and similar technologies
A cookie is a small value a website asks a browser to store and return. Web applications can also use localStorage, IndexedDB, service workers, notification permission and push subscriptions. This policy covers all of them because they can remember a browser or support a feature even when they are not literal cookies.
The current frontend reads and writes localStorage, uses Supabase-managed first-party authentication cookies and registers a Firebase messaging service worker. The repository contains no application use of sessionStorage or application-created IndexedDB databases. Browsers and verified providers may also manage technical storage as part of authentication, map rendering or push delivery.
2. How UntapGo uses storage
Strictly necessary storage
Authentication storage keeps a signed-in session and supplies an access token to the UntapGo backend. Without it, account features such as profiles, event participation and settings cannot work reliably. Security storage used by Supabase during authentication is also necessary for the sign-in flow.
Preferences and requested features
UntapGo remembers the area, coordinates and radius you selected for nearby-event results. These choices stay on the device until cleared or replaced. Your distance-unit preference is stored with your account through the backend rather than in a separate UntapGo localStorage key. Device geolocation is not read silently: it uses the browser permission prompt when you ask for your current location.
If you choose to enable push notifications, UntapGo creates a random device identifier, records that push is enabled, registers a service worker and asks Firebase Cloud Messaging for a push token. Push is optional and requires the browser’s notification permission.
No analytics or marketing categories
No analytics, advertising, conversion-tracking or marketing technology was found in the inspected implementation. Because only necessary storage and user-requested preferences/features are present, UntapGo does not show a general cookie-consent banner. If optional tracking is added, it must be blocked until valid consent and this policy and the interface must be updated.
3. Current inventory
| Name or pattern | Provider / purpose | Type and party | Duration | Consent |
|---|---|---|---|---|
sb-<project-ref>-auth-token and related chunked Supabase auth cookie names | Supabase; persist the authenticated session, PKCE verifier and refresh it after email/password or Google sign-in | Cookie, first-party context | Until sign-out, account/session expiry or browser data is cleared; token lifetimes are managed by Supabase | Strictly necessary; no consent panel |
supabase_token | UntapGo; provides the current access token to authenticated application requests | localStorage, first party | Removed when the app observes sign-out; otherwise replaced with the current session token | Strictly necessary |
untapgo_coords | UntapGo; remembers selected or permitted device coordinates for nearby results | localStorage, first party | Until replaced or browser data is cleared | Requested feature; device geolocation separately requires browser permission |
untapgo_location_label | UntapGo; remembers the human-readable selected area | localStorage, first party | Until replaced or cleared | Preference; no consent panel |
untapgo_radius | UntapGo; remembers event-search radius | localStorage, first party | Until replaced or cleared | Preference; no consent panel |
untapgo:push-device-id | UntapGo; distinguishes a browser installation when saving or deleting its FCM token | localStorage, first party | Until browser data is cleared | Created when push-device functionality is used |
untapgo:push-enabled | UntapGo; remembers that this device completed push setup | localStorage, first party | Removed when push is disabled; otherwise until cleared | Consent through the requested push flow and browser permission |
/firebase-messaging-sw.js, FCM token and browser push subscription | UntapGo / Google Firebase; receive and display optional push messages | Service worker and push/browser-managed storage; first- and third-party service | Until push is disabled, token expires/is replaced, service worker is removed or browser data is cleared | Yes, requested through notification permission |
| Mapbox Search session token | Mapbox; groups suggestion and retrieval requests during a place-search session | In-memory request value sent to a third party | One search-component session; not deliberately persisted by UntapGo | Used only when place search is used; provider storage requires verification |
Exact Supabase key names include a project reference determined by configuration. Exact token expiry and third-party infrastructure storage are controlled by the relevant service and must not be inferred from this frontend.
4. Third-party technologies
Supabase provides authentication and uses first-party cookies necessary to complete, maintain and refresh a session. If you choose Google sign-in, Google and Supabase handle the OAuth exchange and standard identity scopes. Mapbox receives place-search requests, coordinates and ordinary network information when its maps and search APIs are used. Google Firebase receives messaging configuration and a push token when push is enabled. Scryfall-hosted card images may receive ordinary web-request data when loaded, but the frontend does not deliberately set a Scryfall cookie.
Those providers may operate infrastructure storage outside the code UntapGo controls. Their own notices explain their independent practices. The frontend does not establish whether the hosting platform sets infrastructure or security cookies, so {{HOSTING_COOKIE_INVENTORY}} must be checked in production.
5. Legal basis
Authentication and security storage is necessary to perform the account agreement and protect the service. Location-label and radius storage implement choices you request and support the service agreement. Access to device geolocation and delivery of browser push rely on your affirmative browser permission and consent. Consent can be withdrawn at any time.
UntapGo does not ask for consent for storage that is strictly necessary to sign in or provide a specifically requested feature. It also does not treat continued browsing or scrolling as consent.
6. Managing and withdrawing choices
You can disable push in UntapGo notification settings and revoke notification permission in browser or operating-system settings. The app asks its backend to remove the token for that device and asks Firebase to delete the local token on disable, although browser-managed data may also need to be cleared through browser settings.
You can revoke location permission in browser settings. You can change the selected area and radius in UntapGo. Clearing site data removes local preferences, device identifiers and local authentication data. Blocking all local storage may sign you out, prevent session refresh, forget preferences and stop push or nearby-event features from working.
Because no non-essential analytics or marketing technology is active, there is no separate “Cookie preferences” panel. Browser controls are the appropriate current mechanism. A consent panel must be added before any optional tracker is deployed.
7. Changes to this policy
This inventory will be updated when storage behavior, providers or purposes change. A material change involving optional tracking will be presented before that tracking begins, where consent is required.
8. Contact
Questions about browser storage or personal data may be sent to {{PRIVACY_CONTACT_EMAIL}}. Operator: {{LEGAL_ENTITY_NAME}}, {{LEGAL_ENTITY_ADDRESS}}.