Cookie Policy

We keep things minimal. Soul Map uses only strictly necessary storage required to run the Service:

• Authentication cookies — keep you signed in securely (issued by our auth provider, Supabase; HTTP-only where possible).
• OAuth handshake cookies — temporary PKCE/state cookies during Google sign-in, deleted immediately after login completes.
• Preferences (localStorage) — remember your choices on your own device: location consent, onboarding state, theme, map settings. This never leaves your browser.
• Security storage — protects your session, enables rate limiting, and helps detect abuse.

• No advertising or retargeting cookies.
• No third-party analytics trackers (no Google Analytics, no Meta Pixel).
• No fingerprinting or cross-site profiling.
• No data broker integrations of any kind.

When you use Google sign-in, Google may set its own cookies during the authentication handshake. Those cookies are governed by Google's privacy policy, are limited to the sign-in flow, and are not used by Soul Map for tracking.

• Authentication cookies — session-length or refresh-token lifetime; removed when you sign out.
• OAuth handshake cookies — minutes (single flow).
• Preferences in localStorage — until you clear them or delete your account.
• Security logs — short retention window, then deleted.

Strictly necessary storage does not require consent under ePrivacy/GDPR. If we ever introduce anything optional, we will ask first and honour your choice. You can clear cookies and local storage at any time in your browser or device settings. Blocking strictly necessary cookies will prevent sign-in and core features from working.

If our storage practices change, we will update this policy and the effective date above, and announce material changes in the app.

Questions about this Cookie Policy? Email privacy@soul-map.xyz.