Cookies and technologies

Technology Inventory

This is a factual implementation inventory, not a replacement for the Privacy Policy or a claim of legal approval. Provider retention and hosting settings require separate review.

Necessary technologies support requested services and security. Optional analytics remain off without a current consent decision. Declining them does not block public discovery, maps, or account features.

Cookies, browser local storage, temporary tab storage, and native SDK storage are different mechanisms. Your device and network may also create caches and security logs. Withdrawal stops future Jam engagement collection and removes its local measurement ID; it does not erase prior provider records.

Manage or withdraw optional analytics. Browser Global Privacy Control keeps advertising/sale/share uses off and never enables analytics.

Supabase session

Category
necessary
Provider
Supabase
Mechanism
SSR cookies / native SecureStore
Purpose
Requested account authentication and session security
Duration
SSR cookie default 400 days; token/server lifetime depends on Auth settings
Party
Third party
Controls
Sign out; analytics withdrawal preserves authentication

Recovery and invitation continuation

Category
necessary
Provider
Jam
Mechanism
sessionStorage
Purpose
Requested password recovery or invitation acceptance
Duration
Recovery validity one hour; invitation cleared after acceptance/tab close
Party
First party
Controls
Complete or leave the requested flow

Apple identity and OAuth return

Category
necessary
Provider
Jam / Apple
Mechanism
native SecureStore
Purpose
Requested provider authentication and safe navigation
Duration
Consumed by callback/sign-out; credential state controlled by Apple
Party
Third party
Controls
Sign out

Consent choice

Category
necessary
Provider
Jam
Mechanism
localStorage / native SecureStore / private consent ledger
Purpose
Remember and audit privacy choices independently of analytics
Duration
Device decision until replaced; ledger retention requires counsel decision
Party
First party
Controls
Update Privacy Choices; necessary choice storage remains

Location reminder

Category
necessary
Provider
Jam
Mechanism
localStorage / native SecureStore
Purpose
Remember a requested Not Now decision without coordinates
Duration
Seven-day reminder
Party
First party
Controls
Use My Location or choose a town later

Submission anti-abuse identifier

Category
necessary
Provider
Jam
Mechanism
localStorage / native SecureStore
Purpose
Protect requested public submissions
Duration
No client expiration; security retention review required
Party
First party
Controls
Not used until submitting; not an analytics identity

Local development favorites/editor cache

Category
necessary
Provider
Jam
Mechanism
localStorage
Purpose
Requested local functionality only in no-backend fallback
Duration
No coded expiry
Party
First party
Controls
Delete local dev data; remote canonical data unaffected

Map tiles and area search

Category
necessary
Provider
Mapbox
Mechanism
network requests / SDK caches
Purpose
Requested map rendering and town/location lookup
Duration
Provider/cache retention requires review
Party
Third party
Controls
Use list discovery; native telemetry disabled separately

Fraud protection

Category
necessary
Provider
Vercel BotID
Mechanism
security SDK
Purpose
Protect sensitive requested writes
Duration
Provider retention unverified
Party
Third party
Controls
Not a product analytics consent toggle

Jam engagement measurement

Category
analytics
Provider
Jam / Supabase
Mechanism
localStorage / native SecureStore and analytics ingestion
Purpose
Aggregate event and venue engagement, not attendance
Duration
24-hour client ID; configured raw DB cleanup 90 days
Party
First party
Controls
Reject/withdraw analytics; local measurement identifier removed

Vercel Analytics and Speed Insights

Category
Not enabled / not available
Provider
Vercel
Mechanism
web SDK
Purpose
Optional usage/performance measurement disabled until reliable consent lifecycle
Duration
Provider retention review required
Party
Third party
Controls
Not initialized in this release

Expo Insights / Observe

Category
Not enabled / not available
Provider
Expo
Mechanism
native SDK IDs and queue
Purpose
Automatic usage/performance/crash telemetry disabled in fresh builds
Duration
Old binary/provider records unaffected; retention review required
Party
Third party
Controls
Excluded from fresh binaries, not merely gated in JavaScript

Hosted billing

Category
necessary
Provider
Stripe
Mechanism
User-requested web redirect
Purpose
Venue subscription payment and maintenance
Duration
Stripe/accounting retention review required
Party
Third party
Controls
Do not open billing; cancellation does not delete financial records

Transactional email

Category
necessary
Provider
Resend
Mechanism
server outbox / provider API
Purpose
Requested account, business and security communications
Duration
Outbox/provider retention review required
Party
Third party
Controls
Separate from marketing; no marketing consent inferred

Advertising / replay / attribution

Category
Not enabled / not available
Provider
None found
Mechanism
None in application source
Purpose
Not implemented
Duration
Not applicable
Party
First party
Controls
Unavailable; GPC keeps advertising disabled