Cookie and Browser Storage Notice

“Cookies” in this notice includes HTTP cookies, local storage, session storage, IndexedDB and similar device storage. Some storage is required to provide the service. Optional functional and analytics storage is used only in line with your saved choice. You can reopen Cookie Settings in the site footer at any time.

This storage is necessary for a service you request, security, checkout integrity or recording your privacy choice:

• Supabase authentication cookies and local session records (sb-…-auth-token): first-party authentication data; normally retained for the session or token lifetime and refreshed while you remain signed in.
• Cookie choice (neurobuff:cookie-consent): first-party local storage containing your categories, timestamp and notice version; retained for up to 12 months unless you clear it or the notice version changes.
• Security and checkout state: short-lived first-party session or local records used for OAuth, onboarding checkout, billing-portal return, fraud prevention and recovery from interrupted navigation; normally cleared when the flow finishes, the session ends or the record becomes stale.
• Account and legal state: first-party caches used to provide your signed-in experience and remember completion of required onboarding steps; retained until logout, account cleanup, replacement or browser clearing.

With functional consent, first-party local storage can remember theme, dashboard preferences and game configurations. Keys include neurobuff:theme, neurobuff:dashboard-preload-disabled and keys beginning neurobuff:game-settings:. These records normally remain until replaced, you withdraw consent, clear browser data or the related account is cleaned up.

Other local progress and device caches may be necessary to provide a feature you actively use, synchronise signed-in progress or prevent data loss. They are not used for advertising.

• Swetrix: page and product analytics starts only after analytics consent. Data may include page, device, browser, approximate location and event information according to Swetrix configuration.
• Sentry tracing and replay: optional performance tracing and replay starts only after analytics consent. Replay may capture interactions and technical context, subject to masking and filtering.
• Baseline Sentry error monitoring: may operate without analytics consent where necessary for security and reliability. It is configured not to send default personal identifiers, but error reports can contain technical context and are not described as anonymous.

Stripe, Cloudflare, Google or Discord may set strictly necessary cookies when you use their payment, bot-protection or sign-in features. GIF media is served directly by GIPHY, so GIPHY may receive technical request information such as your IP address, browser and the requested media URL. Their own notices govern storage they control.

Choosing Necessary Only disables optional analytics and functional storage governed by our controls. Withdrawing consent stops future optional use, although you may need to clear provider or browser data already stored. Browser blocking can prevent essential authentication or checkout features from working. See our Privacy Policy for data-protection rights.