Cookie Policy
Last updated: July 17, 2026
This page describes the cookies and browser storage that Daaam’s current product code uses. Daaam does not currently run product analytics, advertising, or behavioural tracking.
Cookies Daaam sets
| Name | When and why it is set | Maximum lifetime | Attributes |
|---|---|---|---|
sb-access-token |
After sign-in; authenticates application requests | 7 days | First-party, HttpOnly, SameSite=Lax, Secure in production |
sb-refresh-token |
After sign-in; renews the authenticated session | 30 days | First-party, HttpOnly, SameSite=Lax, Secure in production |
share_verified |
After the correct password is entered for a password-protected share; remembers access | 24 hours | First-party, HttpOnly, SameSite=Lax, Secure in production |
Signing out deletes both Supabase session cookies. The share_verified value contains the protected share slug, a
timestamp, and a cryptographic signature; it does not contain the share password.
These cookies are necessary for the authentication or protected-share feature the visitor requests. Blocking them will prevent sign-in or require a protected share password to be entered again.
Browser storage used by the waitlist
The landing-page waitlist stores one local-storage entry:
| Key | Value and purpose | Functional period |
|---|---|---|
loops-waitlist-last-submit-at |
Timestamp only; prevents another waitlist submission within one minute | 1 minute |
The timestamp may remain in local storage after the one-minute check has expired until it is overwritten or you clear site data. It does not contain the submitted email address. The email itself is sent to Loops as described in the Privacy Policy.
What Daaam does not currently use
- Product-analytics cookies
- Advertising or cross-site behavioural-tracking cookies
- Marketing pixels
- A separate analytics or infrastructure-monitoring script
- A consent-preference cookie, because no optional cookie category is currently offered
Daaam’s infrastructure and external endpoints still receive ordinary request data when your browser connects to them. For example, the hosted DiceBear and Gravatar endpoints receive avatar-request data, and Loops receives a waitlist submission. Those data flows are described in the Privacy Policy; they are not Daaam analytics cookies.
Consent and future changes
We do not display a cookie-consent banner for the current strictly necessary cookies. If Daaam introduces a non-essential cookie or similar browser-storage technology, we will update this page and obtain consent before using it where required.