Last updated: August 16, 2026
1. What Are Cookies?
Cookies are small text files a website stores in your browser to remember information between visits — for example, whether you are signed in. Some are strictly necessary for a service to function; others track behaviour for analytics or advertising. Viridel only uses the first kind for authentication. We also use localStorage and IndexedDB for your app data, which (unlike cookies) are never automatically sent to a server.
2. What Cookies & Storage Viridel Uses
| Cookie / storage | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| sb-[project]-auth-token | Auth | Supabase | Keeps you signed in. Only present if you have signed in. | Session; rotating refresh token |
| sb-[project]-auth-token-code-verifier | Auth | Supabase | PKCE code verifier used during the OAuth flow. Deleted after sign-in. | Login flow only (minutes) |
| IndexedDB / localStorage | Local storage (not a cookie) | Viridel | Stores your local app data and preferences on your device. Never transmitted unless cloud sync is enabled. | Until you clear browser / site data |
That is the complete list of Viridel/Supabase auth and local storage we intentionally use. No advertising cookies, no analytics cookies, no third-party tracking pixels on our domain.
3. What Viridel Does NOT Use
No Google Analytics or GA4, no Meta Pixel or Facebook SDK, no Hotjar or session recording, no Mixpanel or Amplitude, no advertising or retargeting cookies, and no cross-site tracking pixels we control. Outbound third-party connections are to Google (sign-in), Supabase in Frankfurt (authentication and optional Plus sync), Dodo Payments (checkout), Resend in Ireland (transactional email when configured), Vercel in Frankfurt (site origin), and Cloudflare (CDN for public assets, including US-east).
4. Third-Party Cookies & Host Cookies
When you sign in, you are briefly redirected to Google's domain, where Google may set its own cookies under Google's policy. When you purchase, you are redirected to Dodo Payments' checkout, where Dodo may set cookies under its policy. Your hosting/CDN provider may set strictly technical cookies or collect request logs (IP, URL) to deliver the site — those are not Viridel advertising trackers. When you return to Viridel, we do not set cross-site advertising cookies on our domain.
6. Managing and Deleting Cookies
You can manage and delete cookies through your browser settings (Chrome, Firefox, Safari, and Edge all provide per-site controls). Deleting the Supabase auth cookie signs you out but does not affect your local data in IndexedDB or localStorage. To clear local data, use the app's settings or clear all site data.
7. Desktop & Mobile Apps
The desktop (Electron) and mobile (Capacitor) apps do not use browser cookies. Sessions are stored in the OS secure store — iOS Keychain, Android Keystore, or the desktop app's secure storage — sandboxed from other apps. App data lives in native SQLite. Uninstalling the app or clearing its data removes everything locally.
8. Contact
Questions about cookies or our data practices: privacy@viridel.app. Related: Privacy · Security · Refund.
Disclaimer & Updates
These pages describe how Viridel operates as a product. They are not legal advice. We may update them; for material changes we notify signed-in users by email and/or post a notice on the site or in the app. The date at the top of each page is authoritative.