Cookie Policy — Hummingbird (DepEd Abra · DRRM deployment)
DRAFT for review. Matches actual behavior as of 2026-07-12.
Hummingbird uses strictly necessary cookies only. There are no advertising, tracking, or third-party analytics cookies, and therefore no cookie-consent banner is required for the current configuration.
| Cookie | Purpose | Lifetime |
|---|---|---|
Supabase auth cookies (sb-…) | Keep you signed in: session and refresh tokens for the authentication flow. Set on sign-in; refreshed automatically on use | Session persists until sign-out, "Sign out of all devices", an administrator reset/delete, or token expiry |
Not cookies, stored locally on your device:
| Storage | Purpose |
|---|---|
localStorage theme flag | Remembers light/dark mode. Not sensitive, never sent to the server |
IndexedDB offline queue (hb-outbox) | Your own damage reports composed while offline, held until they synchronize — see docs/offline/OFFLINE_DATA_POLICY.md |
| Service-worker cache | Static app files (scripts, styles, icons) so the app shell loads fast; never stores report data or pages |
If analytics are enabled in the future (e.g. Vercel Web Analytics, which is cookieless), this policy will be updated before rollout.