Updated July 10, 2026
This notice describes browser cookies and storage used on filmbuddyapp.com. It should be read with the Privacy Policy.
Current launch configuration
The public marketing and legal pages do not set nonessential cookies or local storage in the audited launch code. A clean signed-out audit of the homepage, login, and signup routes found no cookies, local storage, session storage, IndexedDB, Cache Storage, or service worker. The site does not load browser analytics, advertising pixels, chat, CAPTCHA, remote fonts, fingerprinting, or third-party media embeds. Fonts and brand assets are served as part of the website.
Because the current site uses only strictly necessary authentication technology, it does not display a consent banner. A banner that offers choices for technology that is not present would be misleading.
Strictly necessary authentication cookies
Supabase authentication may set one or more session, refresh, and verification cookies when a user signs up, follows an authentication email link, signs in, updates a password, or uses the beta account portal. Cookie names include the configured Supabase project reference and may be split into chunks when required by browser size limits.
These cookies are used to establish and rotate an authenticated session, complete email-link flows, protect gated pages, and carry out sign-out. They are provided by Supabase for Film Buddy and are not used for advertising or cross-site behavioral tracking. Their duration follows the authentication session or verification flow; sign-out invalidates the Film Buddy session, and browser controls may remove the local cookie sooner.
The production authentication cookie is named
sb-vphhcuwgcyyznphtplov-auth-token. Supabase may split a large value into
numbered cookies such as .0 and .1. It is configured with Path=/,
SameSite=Lax, Secure in production, no Domain attribute, and a maximum
browser lifetime of 400 days. It is intentionally browser-readable
(HttpOnly=false) because the Supabase browser client must refresh the
session. The access token inside the cookie is shorter-lived and the session is
rotated; signing out invalidates the Film Buddy session and removal cookies use
Max-Age=0.
The legal basis in the EU/UK is that the technology is necessary to provide the account and download service requested and to pursue Film Buddy's legitimate interest in keeping that service secure.
Server logs are not cookies
Vercel and the site's delivery infrastructure necessarily process HTTP request information to serve and protect the site. That processing is described under Website and support data in the Privacy Policy; it does not by itself place a cookie in your browser.
Your controls
You can sign out to end the Film Buddy session and can remove site data with your browser controls. Blocking strictly necessary cookies may prevent account, email-confirmation, password-reset, and download features from working. Public marketing, legal, privacy, support, security, and license pages remain available without signing in.
The site does not respond differently to Do Not Track or opt-out preference signals in the current configuration because it does not use nonessential tracking or sell or share personal information for behavioral advertising.
If the technology changes
Before adding analytics, advertising, chat, CAPTCHA, embedded media, remote fonts, fingerprinting, or other nonessential storage, Film Buddy must update the vendor and cookie inventory, publish the relevant retention and transfer facts, and implement any consent or opt-out controls required before that technology loads.
Questions may be sent to hello@filmbuddyapp.com.