Cookie Policy
Version 2026-10-10
The cookies and browser storage items Court Market uses, who sets them and why. It is part of our Privacy Policy.
Placeholder: requires review by a qualified attorney before launch.
In short
- We set cookies and storage only to sign you in, to remember choices you make, and (Stripe) to protect payments.
- We have no advertising or analytics cookies, so there is no cookie banner. The one thing that can track you across visits, Mapbox’s map, stays off until you tap Show map.
- If your browser sends Global Privacy Control, we honour it (see Counting visits).
Everything the website sets
| Name | Type and who sets it | What it is for | How long | Needed? | When it is set |
|---|---|---|---|---|---|
| sb-<project>-auth-token (and numbered parts) | Cookie Court Market, through Supabase Auth | Keeps you signed in. | Until you sign out (renewed while you use the site, at most 400 days) | Essential | When you sign in or create an account |
| sb-<project>-auth-token-code-verifier | Cookie Court Market, through Supabase Auth | Completes sign-in from an emailed link (confirming your email, resetting your password). | Removed as soon as the link is used | Essential | When you ask for an emailed link |
| cm:map-choice | Local storage Court Market | Remembers whether you chose to show maps, so we don't ask again. | Until you clear it (Cookie Policy page, or your browser) | Essential | When you choose Show map or No maps |
| cm:last-location | Local storage Court Market | Remembers the last place you searched, so the home page and search start there. A location from "Use my location" is saved rounded to about 1 km. | Until you clear it (Cookie Policy page, or your browser) | Optional | When you search for courts |
| __stripe_mid, __stripe_sid | Cookie Stripe (Stripe.js), on our domain | Fraud prevention: lets Stripe recognise the same browser across a payment. Stripe also reads device and browser signals on the checkout page. | __stripe_mid one year; __stripe_sid 30 minutes | Essential | Only on the checkout page, where Stripe.js loads |
| m | Cookie Stripe, on m.stripe.com | Fraud prevention: Stripe's device-recognition cookie, read when Stripe.js runs on the checkout page. | Up to 400 days | Essential | Only on the checkout page |
| __cf_bm | Cookie hCaptcha (used by Stripe's fraud checks), on hcaptcha.com | Bot detection for Stripe's checkout challenge. | 30 minutes | Essential | Only on the checkout page |
| mapbox.eventData:… and mapbox.eventData.uuid:… | Local storage Mapbox (Mapbox GL JS) | An anonymous browser id (mapbox.eventData.uuid), its timestamp and the last event (mapbox.eventData), used by Mapbox to count map loads (billing and service statistics). Mapbox GL JS sends these map-load events to events.mapbox.com and we can't switch them off. | Until you clear it in your browser | Optional | Only after you choose Show map |
Cloudflare Turnstile (the check on sign-up and the contact form), Sentry (error monitoring) and Supabase (sign-in) set nothing beyond the sign-in cookies above. Sentry sends an error report to its servers only when something breaks; see the Privacy Policy for what a report contains.
What we don’t use
- No advertising, retargeting or cross-site tracking cookies or pixels.
- No Google Analytics, Meta pixel or similar third-party analytics.
- No analytics cookie or device id: our own counts use a label made on the server for one day at a time (see below).
- No session replay or screen recording.
Counting visits without a cookie
To count things like searches and bookings, and to avoid counting a refresh twice, our server makes a label for a visitor from the request itself: a one-way scrambled mix of the day, the IP address and the browser type, using a key only we hold. The label changes every day, so a visitor can’t be followed from one day to the next; the IP address isn’t stored; and nothing is saved on your device. Labels are deleted from our records after 7 days.
Global Privacy Control. If your browser or extension sends the Global Privacy Control signal, we make no label for you and record no search or page-view events from you.
Your choices
Maps (Mapbox)
You haven’t chosen yet. Maps stay off until you do.
Saved search location
This browser isn’t remembering a search location.
You can also delete any of these items in your browser’s settings. Deleting the sign-in cookies signs you out. Stripe’s cookies are only set on the checkout page.
The mobile app
The app doesn’t use cookies. It stores these items on your device:
- Session key (iOS Keychain / Android Keystore) and the encrypted session in app storage. Keeps you signed in on this device.
- Push notification choice and token copy. Remembers that we asked about notifications, and which token to switch off when you sign out.
- Selected gym (gym accounts). Remembers which of your gyms you were working on.
- Last search results. Shows the last results again if your connection drops. Public court listings only.
The app’s map (Mapbox) has Mapbox’s usage and location telemetry switched off.
For review
For counsel to draft
- Whether the saved search location (cm:last-location) and the map choice (cm:map-choice) count as strictly necessary, and whether any consent is required for them in the places we serve
- Whether Stripe's fraud-prevention cookies and Sentry's error reports count as strictly necessary
- Whether the Mapbox tracker's opt-in design is sufficient, and any extra wording needed for state privacy laws
- The wording of the Global Privacy Control commitment