Cookies and tracking
You’ve never seen a cookie banner on Bowerstead. That isn’t an oversight, it’s the point: we only set the cookies that signing in actually needs, so there’s no tracking to ask you to consent to. This page is the full accounting.
What we set
Sign-in cookies, and that’s the list. When you sign in, our authentication provider (Supabase) sets a cookie that keeps you signed in and gets refreshed as you move around. Without it you’d be signed out on every page. It’s read by us and nobody else, and it disappears when you sign out.
What we don’t set
- No analytics. No Google Analytics, no product analytics, nothing counting your clicks.
- No advertising pixels. No Meta pixel, no Google Ads tag, no conversion tracking. We don’t retarget you.
- No third-party cookies, and nothing following you to other websites.
- No fingerprinting, no session recording, and no tool that plays back what you did on screen.
This is why there’s no banner. The rules that require a consent popup are about tracking and advertising storage. A cookie that only keeps you signed in is one you’ve effectively asked for by signing in, so interrupting you to demand permission for it would be theatre.
Things kept on your own device
Not everything stored in a browser is a cookie, and it’d be a dodge to only talk about cookies. Bowerstead also keeps a little data locally on your device, which never gets sent anywhere on its own:
- Your offline captures. If you note something with no signal, it waits in a queue on your device and syncs to your account when you’re back online.
- Small bits of interface state, so a screen opens the way you left it.
- Your session, in the iPhone app. The app keeps you signed in with device storage rather than a cookie. Same job, different mechanism.
Bowerstead installs as an app, and that needs a service worker. Ours is deliberately thin: it exists so the install works, and it passes every request straight to the network without caching or reading anything.
The one third party that sees a request
Our public landing page loads its typefaces from Google Fonts, which means Google’s servers see the IP address of a browser that loads that page, the way any website you visit does. It sets no cookie and it learns nothing about your family, but it’s a request to someone else’s server and you deserve to know it’s there. Inside Bowerstead itself, where your records are, the fonts ship with the app and no such request is made.
Clearing them
Signing out clears your session. Beyond that, every browser lets you delete cookies and site data, and you can block cookies for bowerstead.com entirely. Fair warning: block the sign-in cookie and you won’t be able to stay signed in, since that’s the one doing the work.
If this ever changes
If we ever add something that watches what you do, we’ll say so here first, and we’ll ask you before it runs, not after. The privacy policy has the wider picture of what we store and who touches it.
Contact
Questions about any of this? Email contact@bowerstead.com.