The short version. We use cookies to keep you signed in. That is it. There are no advertising cookies, no cross-site trackers and no third-party analytics scripts on this site. Our page-view counts run on our own servers and store no IP address, so they cannot be used to recognise you.
1. What we set
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| sb-*-auth-token | Supabase (our auth provider) | Keeps you signed in and protects your session. Strictly necessary — blocking it stops sign-in working. | Until you sign out |
| vochure.consent.v1 | Vochure | Remembers that you dismissed the notice, so it is not shown again. Stored in your browser’s local storage, not sent to us. | Until you clear site data |
Nothing else. If that ever changes, this table changes in the same release and the notice becomes a real choice with an option to decline.
2. How we count page views
We want to know which pages are useful. Doing that with a third-party analytics script would mean handing your browsing to another company, so we do not. Counting happens on our own servers, and:
- We do not store your IP address. An IP is personal data, and keeping one to count visits is liability without benefit.
- Instead we store a one-way hash of your IP, browser and a secret that rotates every day. It distinguishes two visitors on the same day and is meaningless the next, so it cannot follow you over time.
- We record the path only, never the query string — search terms, tokens and email addresses live there.
- Signed-in pages and API routes are not recorded at all.
- No cookie is set by this, and no data leaves our infrastructure.
Under the GDPR and the ePrivacy Directive, consent is required for storage that is not strictly necessary. Because this stores nothing on your device and identifies nobody, there is nothing here to consent to — which is why you see a notice rather than an Accept / Reject box. We would rather tell you the truth than show you a button that does nothing.
3. Third parties
Some things we rely on necessarily see a request when you use them: Vercel serves the site, Supabase stores your account, and Stripe handles payment if you subscribe. They act on our instructions and are covered in the Privacy Policy. We do not embed advertising networks, social media pixels, session recorders or heatmaps.
4. Your controls
Every browser lets you block or delete cookies for a site. Blocking ours only affects sign-in — browsing roles works fine without one. Clearing local storage brings the notice back. If you would like a copy of the data tied to your account, or want it deleted, see Your rights or write to privacy@vochure.com.
5. Changes
If we add anything that tracks you, we will update this page and ask for your consent before it loads — not after. The effective date above tells you when this was last changed.
Questions: privacy@vochure.com · Sulphoor LLC