Cookie and browser-storage notice

Customer verification and session cookies

The HttpOnly nabaperks_pending_phone, nabaperks_pending_email, nabaperks_pending_email_sign_in, and nabaperks_access_recovery cookies each last up to 10 minutes while a phone number, email, email sign-in code, or existing-wallet recovery is checked. The encrypted HttpOnly nabaperks_email_handoff cookie lasts up to 10 minutes after an email is confirmed on a join page that no wallet uses yet; it is tied to that browser and venue, and it creates nothing by itself. The encrypted HttpOnly nabaperks_email_fallback cookie lasts up to 10 minutes after a phone code could not be sent, a number with no cards was confirmed, or email was chosen once a phone code had had time to arrive; it records only that email may be offered on this browser instead of phone, not the number or the address. After verification, the signed HttpOnly nabaperks_customer_session cookie identifies a revocable, device-bound server-side customer session that lasts until you log out on that device or on all devices. The cookie is renewed as you use Nabaperks and lapses after one year without use.

Device and rate-limit cookie

The HttpOnly nabaperks_device cookie is created on application routes and lasts up to one year. It supplies a signed device identifier used by security, existing-wallet continuity, session binding, and rate-limit controls. It does not itself contain or grant customer, loyalty, reward, or consent authority.

Join-journey cookie

The HttpOnly nabaperks_join_journey cookie lasts up to two hours on QR and customer-join journeys. It links steps in the same join flow for first-party observability without placing contact details in the token.

Merchant and administrator authentication

Merchant and administrator sign-in uses Supabase authentication cookies. These cookies support authenticated sessions and are refreshed or removed through the authentication flow. Their exact names and duration are controlled by the current Supabase session configuration.

Interface preference cookie

The merchant interface may store a sidebar_state cookie for up to one year so it can remember whether the sidebar was expanded or collapsed.

Session storage

Nabaperks uses sessionStorage for short-lived information in the current browser tab or session. This includes first-party marketing-funnel continuity and rotating venue-proof selections. The funnel uses a session-only token rather than a persistent browser analytics identity.

Local storage

Local storage may hold an in-progress merchant onboarding draft, a remembered refusal of the soft location prompt, dismissal of the birthday-profile prompt (nabaperks.dob-prompt-dismissed), and dismissal of the add-your-email prompt (nabaperks.email-prompt-dismissed). An older entry recording the sign-in method this browser last used (nabaperks.last-contact-method) is no longer used and is removed when the join or sign-in page loads. Each prompt dismissal is reconsidered after 30 days. Other entries remain until replaced, removed by the application, or cleared in the browser. None is authoritative server-side loyalty, billing, reward, or consent state.

Push notifications and analytics

If you enable browser push notifications, Nabaperks stores the browser push endpoint and encryption keys needed to deliver messages. Erasure disables stored subscriptions and cancels queued notifications. Optional PostHog analytics is sent from the server only when pseudonymous processing is configured; the current implementation does not create a PostHog browser cookie or persistent PostHog browser identity.

Your browser controls

You can remove cookies, local storage, session storage, cached assets, and notification permissions through your browser settings. Blocking authentication or verification cookies prevents the related signed-in or identity-checking features from working. Clearing convenience storage can reset drafts, dismissals, or interface preferences without deleting server-side loyalty records.

Cookie and browser-storage notice.