Cookies & storage

Essential authentication storage

FanForge and its authentication provider, Supabase, use secure session cookies to sign invited users in, refresh their authenticated session and protect private routes. These are necessary for the signed-in service to work. Their lifetime follows the authenticated session and they are cleared or invalidated when the session ends or you sign out.

Verified public-visitor storage

If moderated public engagement is enabled and a visitor deliberately verifies their email address, FanForge sets an HTTP-only, same-site visitor-session cookie named fanforge-public-visitor. It lasts for up to 30 days, cannot be read by page scripts and does not create an Auth user, alpha access or Forge membership. This feature is disabled by default during private alpha.

Audience measurement

Public Forge views may be counted using a privacy-minimised digest that changes daily. FanForge does not retain the raw IP address or source URL for this purpose. This processing happens on the server and is not an advertising cookie.

What FanForge does not currently use

The private-alpha application does not currently set advertising, cross-site behavioural tracking or social-media tracking cookies. If that changes, this inventory and any required consent control must be updated before the technology is enabled.

Appearance preference

The fanforge-theme local-storage value remembers your light or dark appearance choice on this browser. It contains no account details, is not sent to a server and remains until you change it or clear site storage.

Your controls

You can remove FanForge cookies through your browser. Blocking essential authentication storage may prevent sign-in and private Forge access from working. Signed-out public browsing does not require an authenticated session.

Questions

Contact forgemaster@joinfanforge.com with a question or concern about storage used by the application.