Cookie Policy

1. Scope

This policy covers cookies, local storage and similar mechanisms observed in the site code. A cookie is read or written by the browser; `localStorage` is separate storage that is not automatically sent with every request.

2. Strictly necessary mechanisms

Technology	Provider	Purpose	Category	Observed duration
Session and protection cookies	Auth.js / Next.js	Maintain sign-in and protect authentication flows	Strictly necessary	Managed by Auth.js; not explicitly set in the repository
`gsc_oauth_state`	MarketBase / browser	Bind a Google callback to a project and session	Strictly necessary	600 seconds; HTTP-only, SameSite=Lax
`stripe_oauth_state`	MarketBase / browser	Bind a Stripe Connect callback to a project and session	Strictly necessary	600 seconds; HTTP-only, SameSite=Lax
`mb_cookie_consent`	MarketBase / localStorage	Remember the banner category choice	Consent preference	Until site storage is cleared; it is not a cookie

3. Analytics

No analytics service, audience-measurement tool, pixel or tracking SDK was found in `src` or `package.json`. The banner records analytics categories, but no corresponding script consumes them in the current implementation. A future activation requires an update to this policy and prior consent where required.

4. Features and preferences

Local storage prevents the banner from immediately reappearing after a choice. OAuth cookies are tied to an explicit sign-in or integration action. No commercial personalisation, newsletter or advertising cookie was identified.

5. Marketing and advertising

No advertising cookie, pixel, ad script, retargeting tool or marketing technology is present in the repository. The marketing category offered by the interface currently activates no identified processing.

6. Consent, refusal and withdrawal

The banner lets a User accept the offered categories or reject non-essential categories. The choice is stored in `localStorage` and sent to the consent endpoint, which records the categories and an HMAC hash of the source address as evidence of the choice.

There is not yet a persistent preference centre in the interface. To withdraw or change a choice, clear the site data in the browser, remove `mb_cookie_consent` and reload the page; help is also available from [email protected]. Strictly necessary cookies may continue because they are required for the requested session and flows.

7. Browser settings

A browser can block or delete cookies and local storage. Blocking necessary mechanisms may prevent sign-in, OAuth callbacks or consent-choice persistence.