---
title: "Cookie Policy"
description: "Cookie and browser-storage details for the current Daaam website and application."
lastUpdated: "July 17, 2026"
url: "https://daaam.app/legal/cookies"
---
This page describes the cookies and browser storage that Daaam's current product code uses. Daaam does not currently run
product analytics, advertising, or behavioural tracking.

---

## Cookies Daaam sets

| Name               | When and why it is set                                                                 | Maximum lifetime | Attributes                                                |
| ------------------ | -------------------------------------------------------------------------------------- | ---------------- | --------------------------------------------------------- |
| `sb-access-token`  | After sign-in; authenticates application requests                                      | 7 days           | First-party, HttpOnly, SameSite=Lax, Secure in production |
| `sb-refresh-token` | After sign-in; renews the authenticated session                                        | 30 days          | First-party, HttpOnly, SameSite=Lax, Secure in production |
| `share_verified`   | After the correct password is entered for a password-protected share; remembers access | 24 hours         | First-party, HttpOnly, SameSite=Lax, Secure in production |

Signing out deletes both Supabase session cookies. The `share_verified` value contains the protected share slug, a
timestamp, and a cryptographic signature; it does not contain the share password.

These cookies are necessary for the authentication or protected-share feature the visitor requests. Blocking them will
prevent sign-in or require a protected share password to be entered again.

## Browser storage used by the waitlist

The landing-page waitlist stores one local-storage entry:

| Key                             | Value and purpose                                                      | Functional period |
| ------------------------------- | ---------------------------------------------------------------------- | ----------------- |
| `loops-waitlist-last-submit-at` | Timestamp only; prevents another waitlist submission within one minute | 1 minute          |

The timestamp may remain in local storage after the one-minute check has expired until it is overwritten or you clear
site data. It does not contain the submitted email address. The email itself is sent to Loops as described in the
[Privacy Policy](https://daaam.app/legal/privacy#website-and-waitlist-data).

## What Daaam does not currently use

- Product-analytics cookies
- Advertising or cross-site behavioural-tracking cookies
- Marketing pixels
- A separate analytics or infrastructure-monitoring script
- A consent-preference cookie, because no optional cookie category is currently offered

Daaam's infrastructure and external endpoints still receive ordinary request data when your browser connects to them.
For example, the hosted DiceBear and Gravatar endpoints receive avatar-request data, and Loops receives a waitlist
submission. Those data flows are described in the [Privacy Policy](https://daaam.app/legal/privacy); they are not Daaam analytics cookies.

## Consent and future changes

We do not display a cookie-consent banner for the current strictly necessary cookies. If Daaam introduces a non-essential
cookie or similar browser-storage technology, we will update this page and obtain consent before using it where required.