Skip to content
NicheScoutNicheScout home

Legal · Cookies

Four cookies, and two of them are optional.

There is no advertising network on this site, no pixel, no fingerprinting, and no data broker. What is left fits on one page.

Effective
Sep 1, 2026
Last updated
Sep 1, 2026
Status
Unreviewed draft

01Clause

The short version

  • Sign-in cookies are required. Without them you cannot stay signed in, so there is nothing to consent to.
  • Your light/dark preference is stored in localStorage, not a cookie, and never leaves your browser.
  • Google Analytics loads only if the deployment is configured with a measurement id. If it is not set, no analytics script, request or cookie exists at all.
  • When analytics is enabled, the loader checks your browser's Do Not Track setting first and does nothing if it is on.

02Clause

Strictly necessary

Strictly necessary cookies
CookieSet byPurposeLifetime
sb-<project>-auth-tokenSupabase Auth (first party)Holds your session so you stay signed in across requests. httpOnly, so page scripts cannot read it.Until sign-out, or 1 year
sb-<project>-auth-token-code-verifierSupabase Auth (first party)PKCE verifier used for the few seconds of an OAuth or magic-link exchange.Minutes

These are exempt from consent requirements under the ePrivacy Directive because they are strictly necessary to deliver a service you explicitly requested — signing in.

03Clause

Preferences

The light/dark/system theme switch writes a single theme key to localStorage. It is not a cookie, is never transmitted to us, and clearing site data removes it.

04Clause

Analytics

NicheScout can be deployed with Google Analytics 4. It is off unless an operator sets a measurement id in the environment — there is no bundled tracker waiting to be switched on remotely, and with the variable unset the page never contacts Google at all.

Analytics cookies, when enabled
CookieSet byPurposeLifetime
_gaGoogle Analytics (first party)Distinguishes one browser from another so repeat visits are not counted as new people.2 years
_ga_<measurement-id>Google Analytics (first party)Holds session state for GA4.2 years

When enabled we configure IP anonymisation, disable automatic page view collection in favour of an explicit event per navigation, and send no user identifiers, email addresses or workspace content to Google. We do not use Google Signals, advertising features, or audience export.

Operator note — read before enabling

Analytics cookies are not strictly necessary. If you enable them for visitors in the EEA or UK, you need prior consent, and NicheScout does not currently ship a consent banner. Either leave the measurement id unset, or add a consent gate before you do. Treat this as a launch blocker rather than a preference.

05Clause

Cookies we do not set

  • No advertising or retargeting cookies. There is no ad network on this site.
  • No session-replay or heatmap tools.
  • No social media embeds, so no share-button trackers.
  • Stripe sets its own cookies during checkout — but that happens on Stripe's domain, under Stripe's cookie policy, not on ours.

06Clause

How to control them

  • Turn on Do Not Track in your browser and the analytics loader will not initialise.
  • Block or clear cookies for this site in your browser settings. Blocking the Supabase auth cookies will sign you out and keep you out.
  • Install Google's opt-out browser add-on to block GA everywhere.
  • Delete your account and every cookie tied to it becomes meaningless.

What we do with the data behind these cookies is covered in the privacy policy. Questions: privacy@nichescout.app.