Cookie Policy
What we set + why there's no consent banner·Source: docs/legal/COOKIES.md
Draft — pending final legal review. Text marked {{PLACEHOLDER}}is filled in by counsel before publication. Content shown here is a good- faith draft + reflects HallPal's current operational posture, but is not a substitute for legal advice.
Cookie Policy
Suggested public route: /legal/cookies
Effective: {{EFFECTIVE_DATE}}
Last updated: 2026-08-08
What this page is
This page lists every cookie + similar browser-storage item HallPal sets when you use the dashboard at hallpal.divz.io, and explains why we don't ask you to click through a consent banner before setting them.
For the broader picture of what data HallPal collects and how we handle it, see the Privacy Policy.
Why there's no consent banner
Under the EU ePrivacy Directive (Article 5(3)), the UK Privacy and Electronic Communications Regulations (PECR), and California's CalOPPA, a website must obtain user consent before setting cookies that are NOT strictly necessary to provide a service the user requested.
HallPal sets only strictly-necessary cookies — cookies required to keep you signed in, remember your theme preference, and prove you are not a bot on the sign-in page. We set NO cookies for:
- Advertising or ad measurement.
- Cross-site tracking.
- Analytics that identify individual users.
- Social-media integration.
- Third-party marketing pixels.
Because every cookie we set is strictly necessary, no consent banner is required. See §2 for the full inventory.
If we ever add a cookie that is NOT strictly necessary — for example, a product-analytics SDK — we will (a) update this policy 30 days in advance, and (b) surface a consent banner for the new-category cookies before setting them.
1. What's a cookie?
A cookie is a small text file a website stores on your device via your browser. On subsequent visits, the browser sends the cookie back to the site so the site can remember something about you (e.g. that you're signed in).
localStorage and sessionStorage are similar browser-provided storage mechanisms — the site can store small amounts of data locally without using cookies. We use localStorage for a few preferences.
2. Inventory
2.1 Authentication (strictly necessary)
| Name | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
sb-hallpal-api-auth-token | HallPal / Supabase Auth | Keeps you signed in. Sent with every request so the server knows which user you are + which school you belong to. | ~1 hour (refresh-token flow rotates automatically) | HTTP cookie, HttpOnly, Secure, SameSite=Lax |
sb-hallpal-api-auth-token-code-verifier | HallPal / Supabase Auth | Part of the OAuth PKCE handshake used during Google + magic-link sign-in. Set for the duration of a single sign-in flow + cleared on completion. | Session (cleared on successful sign-in or after ~10 minutes) | HTTP cookie, HttpOnly, Secure, SameSite=Lax |
2.2 Bot protection (strictly necessary)
| Name | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
cf_chl_* and related | Cloudflare (Turnstile) | Distinguishes real sign-in attempts from automated bots without asking you to solve a puzzle. Only set on the sign-in page. | Session (cleared when you close the browser) | HTTP cookie, HttpOnly, Secure |
Cloudflare's own privacy statement covers what Cloudflare specifically retains from Turnstile challenges: https://www.cloudflare.com/en-gb/turnstile-privacy-policy/.
2.3 Preferences (localStorage, not cookies)
| Key | Set by | Purpose | Duration | Type |
|---|---|---|---|---|
hp-theme | HallPal | Remembers whether you chose light or dark theme. Read on first paint so the page doesn't flash the wrong theme. Not sent to the server. | Until you clear browser storage | localStorage |
We also set a small number of similar preference keys in localStorage for feature-level preferences (e.g. last-selected filter on the students table). These are local to your browser + never sent to our servers. Clearing your browser's site data for hallpal.divz.io clears them all.
2.4 What we do NOT set
- No advertising or ad-attribution cookies.
- No third-party trackers.
- No social-media pixels (Facebook, LinkedIn, Twitter/X).
- No product-analytics identifiers.
- No session-replay tools.
See SUBPROCESSORS.md §2 for the corresponding list of services we do NOT use.
3. Managing cookies
You can:
- Clear cookies from HallPal — every browser has a "Clear site data" or "Cookies + site data" option under Settings → Privacy that lets you delete cookies for a specific site. Clearing our cookies will sign you out (you'll need to sign in again).
- Block cookies from HallPal — every browser lets you block all cookies for a specific origin. Blocking our cookies will prevent sign-in from working.
- Use "incognito" or "private" browsing — this discards cookies + localStorage on tab close. Useful for one-off access from a shared computer.
4. Do Not Track (DNT) + Global Privacy Control (GPC)
HallPal does not sell or share Personal Data as those terms are defined by CCPA/CPRA. There is nothing to opt out of on our service. HallPal respects Do Not Track + Global Privacy Control signals when set — they are honored as a directive not to enable any future non-essential cookies for that browser.
5. Changes to this policy
Material changes will be posted here + notified to signed-in school administrators. See PRIVACY.md §14 for the notification mechanism.
Contact
Privacy questions: privacy@hallpal.divz.io