Cookie & Storage Notice

1. Customer sessions

The dre_customer_session cookie keeps you signed into the portal after you verify an access link. It expires after seven days or is cleared when you sign out. On production it is Secure, HttpOnly and SameSite=Lax. Blocking it prevents normal portal sign-in.

2. Staff sessions

Supabase authentication cookies, whose names can include a project identifier and numbered parts, maintain staff sessions and refresh access. Their lifetime follows authentication session and renewal settings. We do not claim all authentication cookies have identical security attributes or expiry.

3. Optional saved favourites

The dre_favorite_designs local-storage entry remembers designs you save with the catalogue heart button. It remains in that browser until favourites or site storage are cleared. It does not create an account or subscribe you to email. Same-site code can access browser storage; avoid using shared browsers for private information.

4. Links and external services

Guest links contain access tokens; anyone with a link may be able to use it. URLs can remain in browser history, messages or bookmarks. Keep them private and contact the studio if one is exposed.

Stripe’s hosted checkout may use its own cookies for payment and fraud prevention as described in Stripe’s Cookie Policy. External maps and linked websites have their own storage practices.

5. Your controls

Clear cookies and site data through browser settings and sign out of the portal. Clearing data may sign you out and remove saved favourites. If we introduce optional tracking that requires consent, we will explain it and provide the required choice before enabling it. Contact hello@dearrevel.com for privacy questions.