Cookies and browser storage

Essential storage

Where account forms use Cloudflare Turnstile, the browser loads its security-check script and communicates with Cloudflare. This is limited to protecting the requested authentication or recovery function. Dashpop does not enable Turnstile pre-clearance cookies or use the check for advertising or audience analytics. See the Privacy policy for the network and browser information involved.

Supabase authentication uses sb-…-auth-token cookies (which may be split into numbered chunks) and a temporary code-verifier cookie for sign-in. They maintain and renew your requested session and complete authentication. Their lifetime is set by the authentication configuration; signing out clears the active session cookies. These are not advertising identifiers.

The HttpOnly shell_github_setup cookie links the GitHub setup flow you request to your account. It expires after 15 minutes or is removed when setup completes. It is not used for cross-site tracking.

Session storage holds dashpop.builder-return for your return destination and dashpop-order:… identifiers so a purchase retry does not create a duplicate order. Browser session storage normally ends when the tab closes. The Builder remembers your selected project under dashpop.active-project.v1 in local storage so you can resume it; it remains until replaced or browser data is cleared.

The service worker caches first-party application assets and an offline page to deliver the app experience. Browser caches persist until evicted, updated or cleared. Fonts are bundled locally. Older visits may have left dashpop.telemetry.v1 preferences or ph_… identifiers in browser storage. The disabled browser integration does not read those preferences to enable tracking or send those identifiers. You can remove them through browser settings. Clearing browser data does not delete previously collected events; use our privacy contact for deletion requests.

Choices and legal basis

Storage strictly necessary to provide a digital service you expressly request is used under § 25(2) no. 2 TDDDG. Processing of personal data additionally requires the bases explained in the Privacy policy. Optional browser analytics and session recording are disabled.

Open “Cookies & storage” in any public footer to read a summary without leaving the page. You can remove stored data through your browser settings, sign out to end your authenticated session, or disable browser storage. Removing necessary data may sign you out or interrupt requested features.

Stripe-hosted checkout and GitHub have their own notices for their websites. Following an external link or starting one of those features sends a request to that provider. This page describes Dashpop’s own storage, not every third-party website or independently published game.