Cookies

The short version

SetWright sets three cookies in ordinary use. Two keep you signed in and in the right ensemble, and the third remembers whether you chose light or dark. A fourth exists only while you are resetting a password. None of them track you, none are used for advertising, and none are set by anyone other than us. That is why there is no cookie banner: there is nothing to ask you to consent to.

What a cookie is

A cookie is a small piece of text a site asks your browser to keep and send back on the next request. It is how a site remembers anything at all between one page and the next, and it is what stops you having to sign in again on every click.

Every cookie SetWright sets

Signing you in

Name: sb-<project>-auth-token, sometimes split across a numbered pair when the value is long.
Why: it holds your session, so the app knows who you are. Without it there is no signed-in SetWright at all.
How long: up to 400 days, refreshed while you keep using it.
Turning it off: you cannot, and stay signed in. Signing out deletes it, and so does clearing this site's data in your browser.

It is set by Supabase, the service that stores SetWright's database and handles sign-in. It is a first-party cookie: it is readable only by SetWright, and it is not sent to any other site.

Knowing which group you are looking at

Name: active_ensemble
Why: one login can belong to several ensembles. This holds the one currently in view, so the app shows you the right roster.
How long: until you close your browser.
Turning it off: you cannot, and use the app. It carries no personal information, only which of your own groups you are looking at, and JavaScript cannot read it.

Remembering light or dark

Name: sw_theme
Why: it remembers whether you chose light, dark, or to follow your device. Keeping it on the server side is what stops the page flashing the wrong theme while it loads.
How long: about 12 months.
Turning it off: set the theme back to System and the cookie stops mattering, or clear this site's data to remove it. This is the one cookie here you can live without, and the app works fine with it gone.

It is written only when you actually pick a theme. If you leave the setting on System, which is the default, this cookie is never created.

Resetting your password

Name: sb-<project>-auth-token-code-verifier
Why: asking for a password reset starts a one-time exchange with our authentication provider. This holds the browser's half of it, so the link in the email can only be completed by the browser that asked for it.
How long: minutes. It is written when you ask for the reset and removed as soon as the exchange completes. If you ask and never open the link, it stays until you clear this site's data.
Turning it off: it is never written unless you ask to reset a password, so not using that link is the whole of it.

What SetWright does not set

There are no analytics cookies, no advertising cookies, no tracking pixels, and no third-party cookies of any kind. No other company can read anything SetWright stores in your browser.

SetWright does count page views, measure how quickly pages load, and record errors, through Vercel and Sentry. Neither uses cookies to do any of it, which is why there is nothing for you to opt out of here: the counting is of pages, not of people, and nothing follows you to another site. Section 7 of our privacy policy says what each of those services receives.

Reading this page, the privacy policy or the terms while signed out sets no cookie at all.

Why there is no cookie banner

A banner exists to ask permission for cookies that are not needed to run the service, which in practice means tracking and advertising. SetWright has none. The two sign-in cookies are what the law calls strictly necessary, and the theme cookie only ever appears because you asked for a theme. Putting a banner in front of that would be asking you to consent to nothing, which teaches people to click through the banners that do matter.

If SetWright ever adds anything that does need consent, this page changes and you will be asked properly.

Managing cookies yourself

Every browser lets you see and delete cookies, usually under privacy or site settings, and lets you block them for a particular site. Blocking them for SetWright will stop you signing in, because the sign-in cookie is how the app knows the request is yours.

Deleting SetWright's cookies signs you out and forgets your theme. It deletes nothing in your ensemble: your roster, repertoire and events live in the database, not in your browser.

Do Not Track

SetWright does not respond to the browser Do Not Track signal, because there is nothing here for it to switch off. The signal exists to stop cross-site tracking, and SetWright does none.

Changes

If the list above changes, the date at the top of this page changes with it. A new cookie that tracked anything would also mean a banner, so you would not have to find out by reading.

Contact

Questions about cookies go to privacy@setwright.app.