Cookie Policy

This policy explains the cookies and similar technologies used on [DOMAIN]. It sits alongside our Privacy Policy.

The short version

This site sets one kind of cookie: the one that keeps you signed in. There are no advertising cookies, no third-party analytics cookies, no social media pixels and no cross-site trackers. That is why you are not being asked to accept anything — there is nothing here to consent to beyond what is strictly necessary to sign you in.

What a cookie is

A cookie is a small text file a website asks your browser to store and send back on later requests. It is what lets a site recognise you between one page and the next. Related technologies — local storage, session storage — keep data on your device without sending it anywhere.

Cookies we set

Strictly necessary — authentication

When you sign in, our authentication provider sets session cookies (their names begin with sb- and end in -auth-token; long values are split across numbered cookies). They identify your signed-in session so that you stay signed in as you move between pages, and so the dashboard can tell which dealership you belong to.

• Purpose: keeping you signed in and protecting your session.
• Set by: [DOMAIN] (first-party), through our authentication provider, Supabase.
• Protection: HTTP-only, so scripts on the page cannot read them, and SameSite-restricted so they are not sent from other sites.
• Lifetime: refreshed while you use the site; cleared when you sign out.

These cannot be turned off while you are signed in — the site cannot keep you signed in without them. You can sign out, or block cookies in your browser, in which case you can still read the public pages but cannot use an account.

That is the entire list

We do not set advertising cookies. We do not set analytics cookies. We do not embed third-party trackers, ad pixels, social widgets or session-recording tools. We do not track you across other companies' websites or apps.

Things that are not cookies

• Your theme choice (dark, light or system) is kept in your browser's local storage under ar-theme. It stays on your device and is never sent to us. Clearing your browser's site data resets it.
• App handoff codes — the single-use code that opens your session in the mobile app is not a cookie. We keep only a one-way hash of it on our server; it expires in about two minutes and is destroyed when redeemed.

Managing cookies

Every browser lets you see, delete and block cookies — usually under Settings → Privacy. Blocking all cookies will prevent you from signing in to CarTour. Deleting them signs you out.

Because this site does no cross-site tracking, browser signals such as Global Privacy Control and Do Not Track have nothing here to act on. We honour them for the purposes described in Your Privacy Rights regardless.

The mobile app

The CarTour app does not use cookies. It keeps your session in your device's secure storage. What the app collects is described in the Privacy Policy.

Changes

If we ever add a cookie that is not strictly necessary, we will update this page before doing so and — where the law requires it — ask for your consent first.

Contact

Questions about this policy: [PRIVACY EMAIL].