Cookie Policy | MyBJJStory

This Cookie Policy explains what cookies and similar technologies we use on MyBJJStory, why we use them, and how you can control them. It should be read together with our Privacy Policy.

1. What are cookies?

A cookie is a small text file placed on your device by a website you visit. Cookies let sites remember information such as whether you are signed in, which language you prefer, or how you use the service. This policy also covers related technologies such as browser localStorage and Service Worker storage where we use them.

2. Cookies and similar technologies we use

Strictly necessary

Always active. Without these the Service cannot operate. No consent is required because they fall within the exception in Article 5(3) of the ePrivacy Directive (communication and strictly necessary cookies).

Supabase authentication session: keeps you signed in. First-party cookie, expires at end of session.
CSRF token: protects form submissions from cross-site attacks. First-party, session only.

User-preference (exempt from consent)

Set in response to an action you took (for example, picking a language). These are treated as exempt from consent under the ePrivacy user-choice doctrine, as interpreted by the EDPB in its opinion on the Cookie Banner Task Force report (January 2023) and by the CNIL.

Locale cookie (NEXT_LOCALE): remembers the language you explicitly selected (en / no). First-party, 12 months. You can clear it at any time via your browser settings.

Functional

Set only when you opt in to a specific feature. Legal basis: consent (Art. 6(1)(a) GDPR) and/or performance of a contract (Art. 6(1)(b)).

Push subscription:stored locally via the browser’s Service Worker if you enable push notifications.
Consent preferences: remembers which consents you have given and the policy version you accepted, to evidence compliance with Art. 7(1) GDPR.

Analytics and marketing

At present MyBJJStory does not use analytics or marketing cookies. If we introduce them in the future we will ask for your consent first through a compliant cookie banner that meets the ePrivacy Directive and UK PECR requirements, and we will update this policy.

3. Third-party cookies from sign-in providers

When you sign in with Google, Google may set its own cookies on the google.com domain. Those cookies are controlled by Google and are covered by Google’s Privacy Policy. Supabase may similarly set cookies on its own authentication domain during the sign-in flow.

4. How to manage cookies

You can block or delete cookies through your browser settings. Most browsers let you refuse all cookies or accept only first-party cookies.
You can withdraw consent to optional cookies at any time from Settings → Privacy.
Strictly necessary cookies cannot be switched off; blocking them will prevent you from signing in and using the Service.
You can also opt out of in-browser push notifications at any time through your browser or operating system settings.

5. Changes to this policy

We may update this Cookie Policy when we change the cookies we use. Material changes will be announced in-app or by email. The “last updated” date at the top always shows the current version.

6. Contact

Questions? Email contact@mybjjstory.com.