Cookie & Local Storage Policy

BuildLoop uses a small set of functional browser mechanisms to keep you signed in, remember preferences, and operate the workspace UI. We distinguish cookies, localStorage, and normal browser caching below.

Because optional analytics/tracking cookies are not present, BuildLoop does not show a blocking cookie-consent banner in the current release.

Supabase Auth persists session state in browser localStorage using Supabase-managed keys (typically `sb-<project-ref>-auth-token`). This is required for sign-in and session continuity.

The application sidebar may store open/closed UI state in a functional cookie named `sidebar_state` (path=/, limited max-age). This supports basic UI behavior only.

BuildLoop stores non-secret preferences in localStorage, including: `buildloop.locale` (language selection), `buildloop.activeProjectId` (active workspace selection), `buildloop-connected-repository` (connected repository display metadata in local/demo flows), and `buildloop.productTour.completed.v2` (onboarding tour completion).

These values are functional preferences or UI state — not advertising profiles.

Session tokens are handled by the Supabase client library. BuildLoop does not manually copy session tokens into custom UI fields or expose service-role keys to the browser.

Sign-out clears the Supabase session according to provider behavior.

The current BuildLoop release does not load third-party advertising pixels, marketing analytics SDKs, or optional tracking cookies.

If optional analytics are added in the future, BuildLoop should load them only with appropriate consent controls.

Static application assets (JavaScript, CSS, icons) may be cached by your browser or a CDN/proxy according to normal HTTP cache headers. This temporary caching is not the same as storing your task or specification content in the browser.

Server-side persistence for tasks, specifications, and orchestration evidence lives in Supabase, Firestore, or local development stores — not in browser cache.

You can clear site data through browser settings, sign out to reset auth storage, or remove local preference keys via browser developer tools. Clearing auth storage will sign you out.

Removing preference keys resets language, active workspace selection, or tour completion state.