DoubleYes — Carefully matched. Mutually chosen.
How it works
Menu

Essential technology only

Cookie notice — launch candidate

The Stage 1 design uses authentication and security storage needed to provide requested account features. No advertising, cross-site profiling or behavioural analytics technology is intentionally included.
Launch candidate — not yet approved for registrationReconciled six-document technical candidate 2026-11-07 · these exact candidate bytes are not yet deployed publicly, controller-approved, professionally approved, inserted as approved legal records or activated; access/export, sensitive-consent withdrawal, deletion intake/SLA, simple-state erasure and photo-retention controls are implemented and deployed but await production-like operational acceptance; broader retention enforcement, DPIA sign-off, processor/transfer verification, routable-staging browser-authentication acceptance and final activation remain pending. The open blockers are stated throughout the policy and the legal-readiness record. This page is published for transparent review and must not yet be accepted as a final registration document.

Essential authentication and security

Supabase authentication and DoubleYes use secure session storage or cookies to complete email-link sign-in, keep an authenticated session, prevent request forgery, enforce rate limits and protect private areas. The restricted operator login also uses an essential secure session cookie with HTTP-only access, secure transport, strict same-site handling, server-side expiry and revocation.

These technologies are necessary to provide the account or security function requested by the user. Blocking them will prevent the protected area from working.

Current cookie and storage inventory

  • Supabase authentication cookie: names begin with sb- and end with -auth-token, with numbered chunk variants where needed. Provider: Supabase. Purpose: verified member session and token refresh. Lifetime: provider/session configuration or earlier logout/revocation.
  • __Host-doubleyes_admin: provider DoubleYes. Purpose: restricted local administrator session. Maximum lifetime: eight hours, with a shorter idle limit and server-side revocation.
  • __Host-doubleyes_admin_enrollment: provider DoubleYes. Purpose: one-time administrator authenticator enrolment. Maximum lifetime: 15 minutes.
  • No localStorage or IndexedDB store is intentionally used for private member, administrator or support records, and no service worker provides an offline private-data cache.

What is not used

  • No third-party advertising cookies or retargeting pixels are intentionally included.
  • No behavioural analytics product is intentionally included in the public or Stage 1 application.
  • No service worker stores private account, profile, administrator or support data for offline use.

Future changes and controls

If DoubleYes later proposes non-essential analytics, personalisation or advertising technology, it will update this notice and obtain any consent required before activation. Browser controls can remove or block storage, but essential account functions may then fail.

The final delivery-chain inventory and controlled authentication test remain required before this candidate notice is approved.

Contact information