What is stored
| Key or cache | Purpose | Duration | Information involved |
|---|---|---|---|
sb-<project-ref>-auth-token | Keeps a requested GGMarket account signed in and lets Supabase refresh the session. Large values may be split into numbered cookies such as .0 and .1. | Persistent, with a library maximum age of 400 days. Server expiry, refresh-token rotation, logout, or account security actions may end it earlier. | Encoded access and refresh credentials plus session and user metadata. The value must be treated as confidential. |
sb-<project-ref>-auth-token-code-verifier | Completes a PKCE authentication, email-confirmation, or password-recovery callback securely. | Removed after a successful exchange. An abandoned flow can remain until the same 400-day cookie ceiling or browser deletion. | A random verifier used to bind the browser to the authentication flow; it is not an advertising identifier. |
ggmarket-sw-recovery | Prevents repeated reloads while recovering from an outdated service worker or application bundle. | Per-tab sessionStorage; removed as soon as the application hydrates successfully. | The value 1 only. No account or marketplace information. |
ggmarket-shell-v3 | Keeps the offline page and GGMarket icon available through the browser Cache Storage API in production. | Until the cache version changes, the service worker is removed, or the browser/site data is cleared. | Only /offline and /icon.svg. Authenticated pages and API responses are not cached. |
Security attributes
Supabase authentication cookies use Path=/ and SameSite=Lax. GGMarket adds Secure in production so browsers send them only over HTTPS. No shared Domain is configured.
They are intentionally not HttpOnly: the installed Supabase browser/SSR model must read and replace the cookie to persist and refresh a session. Forcing HttpOnly in this architecture would break authentication rather than harden it.
Your choices
You can use public marketplace pages without an authentication cookie. Signing in, registering, confirming an email, or resetting a password activates storage needed for that request. Logging out invalidates the Supabase session and clears its auth storage; browser settings can also clear site data.
If GGMarket later introduces any optional analytics, advertising, or similar technology, it must remain off until a valid choice is obtained and this policy and the interface must be updated.
Legal context
EU ePrivacy rules exempt storage that is strictly necessary to provide a service explicitly requested by the user. Consent, when required, must still meet GDPR standards and be as easy to withdraw as to give.
Related information
See the Privacy policy for session processing, service providers, rights, and the business details still awaiting owner review.