Cookies

What we store on your device, and why.

Plain language. Last updated 23 May 2026.

The basics

Three categories.

Strictly necessary

Sign-in session, security tokens, and the user-preference cookies that keep the site working. We can’t disable these without breaking sign-in itself.

sb-auth-token / sb-access-token — Supabase Auth session (HTTP-only, Secure, SameSite=Lax).
sb-refresh-token — long-lived refresh token rotated automatically.
theme — your dark / light preference (local to your browser).

Performance

Aggregated, anonymised analytics so the board can see what works and what doesn’t. We do not link this to you personally.

Vercel Analytics — page view and Web Vital metrics, IP-truncated before storage.
(planned) PostHog product analytics — opt-in only, off by default.

No advertising cookies

We do not run ads. We do not sell or share data with ad networks. There are no third-party tracking pixels embedded on this site.

What is a cookie?

A cookie is a small text file that a website stores in your browser. It lets the site remember things between visits — that you're signed in, that you prefer dark mode, that the last page you opened was the directory. Some cookies are set by us; others are set by services we use (Supabase for authentication, Vercel for analytics).

Why we use them

To sign you in. When you sign in with a magic link or Google, Supabase sets a session cookie so we know it's you on the next page load. Without it you'd have to sign in for every request — clearly broken.
To remember your theme. Dark or light mode persists across visits via a small local cookie.
To see what works. Aggregate page view counts and performance metrics help the board understand which sections members actually use. No personal data is attached to these counts.

How to control them

Sign out from anywhere on the platform and the session cookie is invalidated immediately.
Clear site data from your browser settings to remove all cookies set by this site — you'll need to sign in again.
Block third-party cookies in your browser if you prefer. The platform will still work; performance analytics won't fire.
Email us at support@moba2016.com if you want to know exactly what we hold about you, or to ask for it removed.

A small admission.

We don't use a cookie banner on the public pages because, frankly, every cookie we set is necessary for the site to do its job — sign-in, theming, the basic performance metrics that keep things fast. There's no behavioural advertising network behind us to consent to. If a future release ever changes that, we'll add a banner before it ships.