One cookie, and it is the sign-in one.

The cookie we rely on

• The Supabase session cookie (its name begins sb- and ends -auth-token) — set when you sign in and read on each request so that you stay signed in. First-party, and strictly necessary: without it, Compass cannot tell that the writing on the screen is yours. Signing out clears it.

That is the whole list. These public pages — this one, the privacy and terms pages, and the homepage — set no cookies at all.

What we do not have

No Google Analytics. No Meta pixel. No Hotjar, Mixpanel, Segment, Amplitude or FullStory. No session recording. No advertising or remarketing pixels, because Compass carries no advertising. Nothing here follows you to another site.

Counting visits without a cookie

We use Vercel Web Analytics on the public pages to see roughly how many people arrive. It is cookieless and anonymous: it does not set anything on your device, does not build a profile, and cannot identify you.

Local storage

The Supabase sign-in library may keep a copy of your session in your browser’s local storage so that a reload does not sign you out.

Compass also keeps two first-party caches, keyed to your account, so the walk paints before the network answers: your profile (the name you chose, if any) and the seven stretches (which are started or complete, not the writing itself). A cache belonging to one account is never shown to another.

While you are writing, an unsaved draft of the field in front of you — a stretch note, a moment, an insight, or a letter — is kept in local storage so a closed tab or a backgrounded phone does not lose the last words. Saving the field clears that draft. Signing out clears the drafts and both caches. None of this follows you off this site.

Why there is no banner

A consent banner exists to ask permission for cookies that are not strictly necessary. Compass does not set any. There is nothing worth a banner to accept, so we have not built one.

More detail on everything we hold is in the privacy policy.