Cookies & local storage
Current cookie, browser storage and local-file behavior in the Marsward review build.
Current application behavior
Marsward has no advertising or analytics scripts. When Supabase is configured, account sign-in uses HttpOnly session and PKCE cookies; session cookies use Secure on HTTPS. Signing out clears this browser’s account session. Local/workspace Vercel OAuth and workspace GitHub App authorization use separate temporary, ten-minute browser-binding cookies; neither contains a provider access token. Local inventory remains in an API-managed file. Account workspace inventory and encrypted Vercel authorization are stored in Supabase, not browser localStorage. Unsaved scan results and interface selections are transient browser state.
The development framework, browser and any extensions may maintain their own technical state. This notice does not describe third-party sites you open from dashboard links.
Future changes
If analytics, additional authentication providers or other storage is added, this notice must be updated with the actual technologies, purposes, providers and retention. Consent controls must be implemented where required before activating optional tracking. No decorative consent banner is used for technologies that are not installed.