1. What cookies and similar technologies are
Cookies are small values stored by a browser and sent with relevant web requests. Local storage remains until it is cleared, while session storage normally lasts for the current browser tab. We describe all three here because they can remember information about a browser even when they are not used for advertising.
2. Categories
- Essential: required for authentication, security, booking and form continuity, consent storage and staging access where applicable. These cannot be switched off through the preference manager.
- Analytics: optional measurement of adult visitors' use of servingT with Google Analytics 4. It is not loaded, and sets no identifier, unless you allow it.
- Advertising and personalisation: optional adult-user advertising personalisation or audience activation. No advertising pixel, identifier, matched-audience tool or provider is currently installed.
Rejecting non-essential categories does not prevent login, passwordless authentication, booking requests, instant bookings, draft continuity, Stripe Checkout or security controls.
3. Current first-party inventory
| Name | Provider and purpose | Category | Typical duration |
|---|---|---|---|
sb-<project>-auth-token and chunked variants | servingT / Supabase. Maintains and refreshes the authenticated session. The exact project-derived name can vary by environment. | Essential | Controlled by the Supabase Auth session and cleared on sign-out or expiry. |
serving_t_login_email | servingT. Carries the submitted email and a sign-in-method presentation hint in encrypted form between the email-first and password or email-code steps. It is not available to browser scripts and is never an authorisation signal. | Essential | 15 minutes, or cleared when the sign-in step finishes. |
serving_t_booking_draft_<opaque-id> | servingT. Stores an unguessable, HTTP-only claim secret so the same browser can securely continue an unauthenticated booking draft. Personal booking details remain in the protected database record rather than this cookie. | Essential | 24 hours. A consumed or expired secret no longer authorises draft access. |
serving_t_cookie_consent | servingT. Stores the consent-policy version, an opaque consent ID, category choices and update time. | Essential | 180 days, then choices are requested again. |
__Host-serving-t-staging-access | servingT. Protects a non-production staging deployment behind its access gate; it is not used on normal production pages. | Essential | Up to 7 days. |
_ga and _ga_<container-id> | Google Analytics 4. Pseudonymous identifiers that distinguish browsers and sessions so servingT can measure visits, campaigns and booking-funnel steps. Set only after Analytics is allowed and removed on withdrawal. | Analytics | Up to 2 years unless withdrawn or cleared. |
serving_t_analytics_events | servingT. Briefly carries a confirmed outcome, such as a completed sign-up or submitted application, to the next page so it can be counted in Google Analytics. It contains no name, email address or account ID. Set only after Analytics is allowed. | Analytics | 5 minutes, or cleared when read. |
4. Current local and session storage
| Name | Purpose | Category | Typical duration |
|---|---|---|---|
serving-t-partner-setup-guide | Remembers whether an authenticated hitting partner expanded or collapsed the setup guide. | Essential preference | Until browser storage is cleared. |
serving-t:partner-application-draft | Preserves an in-progress partner application in the current tab, including entered application details. | Essential continuity | Current browser-tab session. |
serving-t-message-draft:<conversation> | Preserves an unsent booking message in the current tab and removes it after the message is sent. | Essential continuity | Current browser-tab session. |
serving_t_analytics_purchases | Lists the opaque payment references already counted in Google Analytics so a refreshed confirmation page is not counted twice. Used only after Analytics is allowed and removed on withdrawal. | Analytics | Until browser storage is cleared or Analytics is withdrawn. |
5. Third-party services
When a user chooses to visit Stripe's hosted Checkout or Connect onboarding, Stripe may use its own essential security, fraud-prevention and payment cookies under its policy. Supabase and Vercel may process request and security information needed to provide their services. servingT does not classify a third party's optional advertising cookie as essential merely because that provider also supplies an essential service.
If you allow Analytics, servingT loads Google Analytics 4 from Google. Google Signals and advertising personalisation are disabled, and servingT does not send names, email addresses, phone numbers or free-text form content to Google Analytics. The application contains no advertising pixel, audience matching tool or CAPTCHA. Before any other optional provider is introduced, it must be assigned to the correct category and prevented from loading until the required choice is present.
6. Changing or withdrawing your choice
Use at any time. A withdrawal updates the consent timestamp, stops future optional initialisation and removes removable first-party optional identifiers where technically feasible, including the Google Analytics identifiers listed above. Browser controls can also clear all cookies and storage, although doing so may sign you out or remove unsent drafts.
7. Contact
For a question about these technologies or your choices, email hello@servingt.com. See the Privacy Policy for access, correction and complaint rights.