Cookie Policy

1. Introduction

This Cookie Policy explains how My Life Advocates uses cookies and similar technologies. It is placeholder development content based on what the application actually uses today. It has not been reviewed by a licensed attorney and must be replaced before a production launch.

2. What cookies are

Cookies are small text files stored on your device by a website. They help the site keep you signed in, remember preferences, or understand how the product is used. Similar technologies can include local or session storage in the browser.

3. What we use today

Based on the current codebase and integrations:

• Supabase authentication cookies— required to maintain your signed-in session. Cookie names typically follow Supabase's pattern (names starting with sb- and including auth-token). These are set and refreshed through our server and middleware integration with @supabase/ssr. Without them, sign-in and authenticated pages cannot work reliably.
• No third-party product analytics cookies — the application does not currently integrate Google Analytics, Plausible, PostHog, Segment, or similar marketing/analytics trackers. If those are added later, this policy must be updated and a consent approach considered where required by law.
• Browser storage — the MVP does not rely on first-party localStorage or sessionStorage as a primary product feature for auth or preferences. The browser or hosting edge may still use ordinary technical storage as part of normal web operation.
• Payment flows— when you use Stripe Checkout or Stripe-hosted surfaces, Stripe may set its own cookies under Stripe's domains and policies. Those are controlled by Stripe, not by custom analytics code in this app.

4. Why we use them

• Essential operation — keep you signed in across page loads and secure API/server requests.
• Security — support session integrity for authenticated routes (client, advocate, and admin areas).
• We do not currently use cookies for advertising or cross-site tracking in the My Life Advocates application itself.

5. Managing cookies

You can clear or block cookies in your browser settings. If you block Supabase auth cookies, you will likely be unable to remain signed in. The MVP does not ship a separate in-app cookie-consent banner; whether one is required before launch depends on jurisdiction and counsel advice (especially under GDPR/ePrivacy-style rules).

6. More information

For how we handle personal data more broadly, see the Privacy Policy. For account use rules, see the Terms of Service.