Legal
Cookie Policy
Faultline uses essential browser storage only. This page lists every item and its purpose.
What cookies and storage are
Cookies are small values a site can store in your browser. Local storage and session storage are similar browser APIs. They can remember a preference or keep a session working. Some are strictly necessary; others are used for analytics or advertising.
Our approach
The current release uses only essential browser storage. We do not use analytics, advertising, tracking pixels, or third-party marketing cookies, so there is nothing optional to accept or reject. The notice you see is informational; it is not a consent gate.
If we add non-essential storage later, we will ask for consent first, make rejecting as easy as accepting, update this policy, and change the notice version.
What we store
These items are first-party and are used only to run the practice lab.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
faultline-cookie-notice-v1 | localStorage | Remembers that you dismissed the storage notice. | Until you clear site data. |
faultline-tour-v1 | localStorage | Remembers your onboarding-tour progress and status. | Until you clear site data. |
faultline-shop-v1 | sessionStorage | Keeps the simulated shop cart and active attempt key for the current tab. | Until the tab closes. |
If accounts are enabled
Accounts are disabled in the current release, so Supabase Auth cookies are not set. If accounts are enabled later, sign-in will set sb-<project-ref>-auth-token cookies (possibly split into .0, .1, and later chunks) and a short-lived sb-<project-ref>-auth-token-code-verifier cookie during the magic-link exchange.
Those cookies are strictly necessary to keep you signed in. They use SameSite=Lax, are readable by JavaScript, and currently have a maximum age of 400 days. They are only sent over HTTPS in production. We will update this policy and the notice before enabling accounts.
Legacy cookie
Older builds may have set a faultline_tester_id cookie. The current build does not create it. It is read only when accounts are enabled and no Supabase session exists, and it is deleted on sign-out.
No analytics or advertising
We do not load Google Analytics, advertising pixels, session replay, or third-party marketing scripts. We do not use remote fonts, CDNs, or third-party iframes. The sandbox iframe points at Faultline's own routes.
Managing storage
You can clear cookies and site data in your browser settings. Clearing site data removes the tour and shop-cart state and makes the storage notice appear again. Blocking storage does not stop you playing a guest challenge, but the tour may reappear and some sandbox conveniences may not persist.
Future changes
If we introduce analytics or another non-essential feature, we will update this page first, add a real consent control, and bump the notice version so returning visitors see the change.
Contact
Questions about storage: help@bughuntlab.com