Homedrawer uses a small number of cookies. Only the essential ones are set without asking. Everything else is off until you turn it on, and you can change your mind at any time.
Categories
| Category | Purpose | Consent |
|---|---|---|
| Essential | Keeping you signed in, security, remembering which household you are viewing and your cookie and theme choices. | Always on |
| Analytics | Google Analytics 4 — anonymised counts of which pages and features are used. IP addresses are anonymised; no advertising features are enabled. | Opt-in |
| Functional | Reserved for remembering conveniences in this browser, such as your last-used filters. Nothing is set yet in this version. | Opt-in |
| Marketing | Not used. Reserved for measuring a campaign if we ever run one; nothing loads unless enabled. | Opt-in |
The cookies themselves
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
sb-*-auth-token | Homedrawer (Supabase Auth) | Your sign-in session | Up to 400 days, refreshed while you stay signed in |
hd_household | Homedrawer | Which household you last viewed | 1 year |
hd_consent | Homedrawer | Your cookie choice | 6 months |
hd_theme | Homedrawer | Light or dark, only if you chose | 1 year |
_ga, _ga_* | Google Analytics | Analytics (only after opt-in) | Up to 2 years |
Your control
Accepting and rejecting are equally easy in the banner, and neither is pre-selected or pre-focused (Quebec Law 25, GDPR). To change your mind later, use “Manage cookies” in the footer of any public page, or Settings → Profile → Cookies once you are signed in.
Rejecting stops the optional scripts from ever loading. Withdrawing after you had accepted does more than mute them: we delete the Google Analytics cookies and reload the page, because a tag that has already loaded cannot be removed any other way and would otherwise keep sending data without cookies. You may also delete cookies in your browser. We record your choice in the cookie itself and nowhere else.
Analytics runs only on our public pages — the home page, the legal pages and the sign-in and sign-up screens. It is never loaded inside your account, and never on an invitation link, so the addresses of your own records and your invitation links are not shared with Google. We never send query strings to analytics.