Last updated: 16 October 2026
The cookies
| Name | Set by | What it does | How long |
|---|---|---|---|
| sb-…-auth-token (sometimes split into .0, .1) | Glucogaze (Supabase sign-in) | Keeps you signed in. Your browser's scripts can't read it. | Until you sign out, renewed while you use the site (at most 400 days) |
| sb-…-auth-token-code-verifier (and …-flow-…-code-verifier) | Glucogaze (Supabase sign-in) | Makes sure a Google sign-in, or a sign-up or reset link we email you, finishes only in the browser that started it. | Until that sign-in finishes |
| gg-person | Glucogaze | Remembers which person your dashboard, History and Settings show, so their id never sits in the address bar. | 1 year |
| gg-consent | Glucogaze | Carries your health-data consent tick through a Google sign-up. Sent only to the sign-in callback. | 10 minutes, or until the sign-up finishes |
| Cloudflare's own | Cloudflare Turnstile | May be set by the “are you human?” check on the sign-in, sign-up, password-reset and waiting-list pages, to stop abuse. | Up to Cloudflare |
What we don’t set
No advertising, tracking or analytics cookies. Our page-view and page-speed statistics (Vercel Web Analytics and Speed Insights) use no cookies and build no profile of you. When you pay, Stripe’s checkout runs on Stripe’s own site (checkout.stripe.com), which sets its own cookies under Stripe’s cookie policy, not ours.
Why there is no banner
The law lets a site use cookies without asking when they are strictly necessary for a service you asked for, as every cookie above is. Blocking them in your browser will stop sign-in working. More on how we use your data is in the Privacy Policy.