Last updated: 11 September 2026
Draft. Not yet in effect.
This page is a draft prepared ahead of the formation of Kirobyte, LLC. The company does not yet exist as a legal entity, so this policy is not in effect and nothing on it is binding on anyone. It takes effect on a date that will be published here once formation completes.
This build of xerobytes.net sets three cookies, and every one of them is strictly necessary. All three are listed below under their real names, with what they do and how long they last.
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
| sb-<project-ref>-auth-tokenand its .0 and .1 chunks | Your signed-in session. Holds the Supabase access token, the refresh token that keeps you signed in, and a copy of your account details, which include the details Google sent if you signed in with Google. Straight after a Google sign-in it can also hold the short-lived access token Google issued, until the session next refreshes; nothing on the site uses it. It is split across numbered chunks when it is too large for a single cookie. | Strictly necessary | Up to 400 days, renewed while you keep using the site |
| sb-<project-ref>-auth-token-code-verifier | A single-use PKCE verifier that proves a sign-in exchange started in this browser. The Supabase client writes one when you start signing in with Google, and also when you sign up, ask for a password reset, or change your email address. | Strictly necessary | Removed when a Google sign-in completes or you sign out. Otherwise up to 400 days |
| csrfSecret | Cross-site request forgery protection. Lets the server confirm that a form submission came from a page this site served, and not from another site acting as you. | Strictly necessary | Session. Removed when you close the browser |
The two Supabase cookie names contain the project reference of the database this site talks to, so in your browser they read as sb-<project-ref>-auth-token with the reference filled in. You can see the exact names in your browser's cookie list for this site.
The session cookie is not marked HttpOnly. The Supabase client library runs in your browser and has to read it there, so JavaScript served by this site can see it. It is sent with SameSite=Lax. It is not currently marked Secure, so it is not restricted to HTTPS by the browser, although the site itself is served over HTTPS. The CSRF cookie is HttpOnly, SameSite=Strict and, in production, Secure.
Four further names may sit in your browser from the starter kit this site is built on, or from an earlier version of it: layout-style, lang, theme and sidebar:state. This build writes none of them, and reads only the first, and only in the signed-in area.
The other three are inert. theme is ignored outright, because the site is dark-only and fixes that on the server whatever the cookie says. lang is no longer consulted; an earlier build wrote it from a language detector running in your browser, which has since been turned off. sidebar:state was written by an earlier build but never read back by anything, so it has been removed. None of the four will be recreated once it expires or you delete it.
There is no consent banner on this site, and no consent choice is recorded anywhere. That is a description of how the site currently works, not a formal consent framework.
All three cookies are strictly necessary. Without them you cannot sign in, stay signed in, or submit a form safely, and consent rules exempt cookies that are strictly necessary to deliver a service you have asked for. Nothing here relies on you not objecting.
This build previously set a fourth, sidebar:state, which was an interface preference rather than a necessity. Under regulation 6 of the UK PECR and Article 5(3) of the EU ePrivacy Directive a cookie that is not strictly necessary needs consent, and no other justification stands in for it. Rather than ask you to consent to it, we removed it. It turned out nothing ever read the value back, so it was doing no work in the first place.
There are no advertising, analytics, or tracking cookies to ask you about. A cookie banner component exists in the codebase, also inherited from the starter kit, but it is never rendered and it collects nothing. If measurement, advertising, or any third-party script is ever added, a working consent mechanism will be added first and this page will be updated before that ships.
Every browser can list, block, and delete cookies for a single site. What happens if you do:
Everything that does not require an account works with all cookies blocked.
There are no advertising cookies, no analytics cookies, and no tracking or cross-site identifiers. No tag manager, no advertising pixel, no session replay, no product analytics, and no error reporting or telemetry service is installed. Cloudflare Turnstile runs on the sign-in, sign-up, magic link and password reset forms to tell people from bots. It sets its own cookies on those pages and is described in the table above. The Inter typeface is self-hosted and compiled in at build time, so your browser never requests a font from Google.
Browser storage is not used to hold personal data. The inventory scanner is the one place it might otherwise be: its OCR runs entirely in your browser against files served from this domain, and it deliberately disables the OCR engine's own cache so that nothing is written to IndexedDB. The screenshot you give it is read and processed in the page and never leaves your device.
Signing in with Google does not change this. The Supabase client keeps its sign-in state in the cookies listed above, not in browser storage.
Cookies are not the only way a visit can be observed. The site is hosted on Cloudflare, which terminates TLS and therefore handles request metadata including your IP address. Accounts, the database, and avatar storage are provided by Supabase, and your browser connects to it directly, so Supabase also sees your IP address. If you choose to sign in with Google, your browser goes to Google to do it, so Google sees that visit under its own privacy policy. If your profile picture came from Google, your browser also loads it from Google whenever the site shows it to you, such as in your account menu. Google sign-in uses the two Supabase cookies listed above and adds none of its own on this site. The privacy policy covers what these providers receive and what is stored.
xerobytes.net is operated under the name Kirobyte, LLC (in formation). The company has not been filed yet. It will be a limited liability company organised under the law of Texas. Kirobyte, LLC's registered office address will be on public record with the Texas Secretary of State once the company is filed. Questions about this page can be sent to privacy@kirobyte.com.
This page is updated when the cookies change, not on a schedule. The current version is always the one published here.