Cookie Policy
Last updated: September 8, 2026 • Version 1.1.6
1. What Are Cookies
Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work more efficiently and to provide information to the website owners.
Cookies help websites remember your preferences, keep you logged in, and understand how you use the site. Some cookies are essential for a website to function, while others help improve your experience or provide analytics.
There are two main types of cookies:
- Session cookies — Temporary cookies that are deleted when you close your browser
- Persistent cookies — Cookies that remain on your device for a set period or until you delete them
2. How We Use Cookies
Frostlete uses cookies for the following purposes:
- Authentication — To keep you securely logged in and maintain your session
- Security — To protect against unauthorized access and fraudulent activity
- Accessibility — To apply your signed-in motion, contrast, and transparency choices before the interface loads
- Optional preferences — To remember non-essential convenience choices
We design our cookie usage to be minimal and privacy-respecting. We do not use cookies for advertising purposes, and we do not sell data collected through cookies to third parties.
3. Cookie Categories
We categorize cookies based on their purpose. Understanding these categories helps you make informed decisions about which cookies to accept.
3.1 Essential Cookies (Always Active)
These cookies are necessary for Frostlete to function properly. They enable core features like secure login, account recovery, consent enforcement, and recording your consent decision. For signed-in users, they also prevent selected accessibility settings from being briefly replaced by default motion, contrast, or transparency while the interface starts.
You cannot disable essential cookies as they are required for the service to work. These cookies do not require your consent under GDPR as they are strictly necessary.
3.2 Functional Cookies (Optional)
These cookies enhance your experience by remembering your preferences and choices. They are not strictly necessary and are limited to optional convenience features.
If you disable functional cookies, some features may not work as smoothly, and we may not remember your preferences between visits.
3.3 Analytics Cookies (Optional)
Analytics help us understand how visitors use Frostlete by collecting anonymous information about page visits and which routes are used.
Frostlete uses Vercel Web Analytics, a cookieless measurement service. It does not set analytics cookies. It still records page views, approximate visitor counts, and device or browser category, so we load it only after you accept Analytics in the cookie banner or privacy settings. If you refuse Analytics, or your browser sends Do Not Track, the script is not loaded. Capability links (invites, join codes, check-in, and similar one-time URLs) are sent only as generic routes, without the token, query, or fragment.
3.4 Marketing Cookies
Marketing cookies are used to track visitors across websites to display relevant advertisements.
Frostlete does not use marketing or advertising cookies. We believe in a privacy-first approach and do not engage in behavioral advertising.
4. Cookies We Use
The tables below list cookies Frostlete currently sets directly, together with the Supabase authentication cookies used by the web app. Section 5 describes other providers that may set security or infrastructure cookies outside this runtime inventory.
4.1 Essential Cookies
Swipe horizontally or use the Left and Right Arrow keys to see all columns.
| Cookie Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
| frostlete-event-checkin | Frostlete | Keeps the event check-in token available while you sign in. It is limited to the selected event's check-in path. | 24 hours | Persistent (HttpOnly, Secure in production, SameSite=Lax) |
| sb-*-auth-token | Supabase | Stores your authentication session to keep you logged in securely | Varies by session; up to 400 days | Persistent |
| sb-*-auth-token-code-verifier | Supabase | Security token used during the login process (PKCE flow) to prevent attacks | Until code exchange; up to 400 days | Persistent until exchanged |
| fg_exp | Frostlete | Stores compact, non-identifying codes for your signed-in experience and accessibility choices so supported settings can apply before the interface loads. Frostlete reads it only with an authentication cookie and clears it when you sign out. | 1 year or until sign-out | Persistent |
| cookie_consent | Frostlete | Records your consent decision, including rejection, so Frostlete can honor it without asking again on every page | 1 year | Persistent |
| _last_active | Frostlete | Limits how often Frostlete refreshes your signed-in account activity timestamp | 1 hour | Persistent (HttpOnly) |
| pending_reconsent | Frostlete | Routes a signed-in account to a required privacy or consent review after relevant terms change | 1 week or until completed | Persistent (HttpOnly) |
| __Host-frostlete_auth_confirmation_* | Frostlete | Temporarily binds one email confirmation, invitation, sign-in, email-change, or password-recovery link to its deliberate confirmation step. Each link uses an isolated random suffix. | 10 minutes | Persistent (HttpOnly) |
| __Host-frostlete_auth_confirmation_meta_* | Frostlete | Temporarily binds the displayed purpose of an email action to the same isolated confirmation flow without exposing its one-time authentication token. | 10 minutes | Persistent (HttpOnly) |
| __Host-frostlete_auth_confirmation_pending_* | Frostlete | Temporarily stores an encrypted, flow-bound pending authentication session after an email link is verified, so Frostlete can identify the masked account and wait for your deliberate confirmation before switching the browser session. | 5 minutes or until accepted or declined | Persistent (HttpOnly, Secure, SameSite=Lax) |
Note: The asterisk (*) in cookie names represents a unique project identifier that varies by installation.
4.2 Functional Cookies
Swipe horizontally or use the Left and Right Arrow keys to see all columns.
| Cookie Name | Provider | Purpose | Expiry | Type |
|---|---|---|---|---|
| sidebar_state | Frostlete | Remembers whether the sidebar in Frostlete’s administration area is open or collapsed | 1 week | Persistent |
| NEXT_LOCALE | Frostlete | Remembers the language selected for localized tournament interfaces | 1 year | Persistent |
4.3 Local Storage
The cookie-consent controls also use browser local storage as a resilient, device-local copy of your consent choices. Local storage remains on your device until you clear your browser data or reset your consent. Frostlete honors this copy as a fallback for no more than one year from the recorded choice.
One further key is written only when you have accepted Functional storage. If you build a team sheet with the free Rugby XV Builder on frostlete.com and choose “Save to your club”, the sheet travels in the part of the web address after the “#”, which your browser never sends to any server. Signing up takes you out of Frostlete and back through a link in your email, and that part of the address does not survive the trip — so the sheet waits in this browser until it opens in your club. It is removed the moment it opens, and withdrawing Functional consent removes it immediately.
| Key | Purpose | Category |
|---|---|---|
| cookie-consent | Stores the same consent choices as the essential cookie_consent cookie as a browser-local fallback | Essential |
| frostlete.team-sheet-handoff | Holds a team sheet you built with the free Rugby XV Builder — the squad list you typed, the fixture details and two club colours — while you sign up, so it can be saved into your club. Removed when the sheet opens, and when Functional consent is withdrawn | Functional |
4.4 Session Storage
Session storage is cleared when the browser session ends. Frostlete uses it for short-lived coordination that avoids unnecessary requests.
| Key | Purpose |
|---|---|
| cookie-consent:db:last-check | Records when signed-in consent choices were last checked against the server so Frostlete does not repeat the same synchronization request |
5. Third-Party Cookies
Some cookies on Frostlete are set by third-party services that we use to provide our platform.
5.1 Supabase
We use Supabase for authentication and database services. Supabase sets cookies to manage your login session securely. These are essential cookies required for the service to function.
For more information about how Supabase handles data, visit their Privacy Policy.
5.2 Hosting Provider
Our platform is hosted on Vercel. Vercel may set cookies for security and performance purposes. These are essential cookies that help protect against attacks and ensure reliable service delivery.
For more information, visit Vercel's Privacy Policy.
5.3 Vercel Web Analytics
When you accept Analytics, Frostlete loads Vercel Web Analytics. Vercel measures page views on Frostlete's own origin and does not set analytics cookies for this service. The measurement can include the page path, referrer, country, and device or browser category. You can stop it at any time by turning Analytics off in cookie preferences.
For more information, visit Vercel's Web Analytics privacy documentation.
6. Managing Your Cookies
You have several options for managing cookies on Frostlete and in your browser.
6.1 Cookie Preferences
When you first visit Frostlete, you will see a cookie banner allowing you to accept or customize your cookie preferences. You can change these preferences at any time by visiting your privacy settings.
Note: Essential cookies cannot be disabled as they are required for the service to function.
6.2 Browser Settings
Most web browsers allow you to control cookies through their settings. You can typically:
- View what cookies are stored on your device
- Delete all or specific cookies
- Block cookies from specific sites
- Block all cookies (note: this will prevent you from logging in)
- Set preferences for first-party vs third-party cookies
Here are links to cookie management instructions for popular browsers:
6.3 Do Not Track
Some browsers offer a "Do Not Track" (DNT) feature that sends a signal to websites requesting they not track your browsing activity. Frostlete treats DNT as a refusal of optional Analytics and other non-essential categories, and does not load Vercel Web Analytics in that case. Frostlete does not use advertising cookies.
6.4 Impact of Disabling Cookies
If you disable cookies:
- Essential cookies disabled: You will not be able to log in or use Frostlete
- Functional cookies disabled: We may not remember your preferences for optional interface conveniences such as sidebar layout or tournament language
- Analytics disabled: Frostlete will not load Vercel Web Analytics, so your visits will not appear in anonymous usage reports
7. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in our practices, technology, or legal requirements.
When we make changes:
- We will update the "Last updated" date at the top of this page
- For significant changes (such as introducing new cookie categories), we will notify you via our cookie banner or by email
- Optional Analytics is loaded only after you accept that category. If we introduce other optional cookies, we will request your consent before setting them
We encourage you to review this policy periodically to stay informed about our use of cookies.
8. Contact Us
If you have questions about this Cookie Policy or our use of cookies, please contact us:
Privacy Inquiries
Email: privacy@frostlete.com
General Support
Email: support@frostlete.com
Related Policies
For more information about how we handle your data, please also review:
- Privacy Policy — How we collect, use, and protect your personal information
- Terms of Service — The rules and guidelines for using Frostlete