Cookies and Similar Technologies
Edition 2026-10-30.1. Documents approved. Contractual acceptance is not enabled.
These documents have been approved. Account acceptance will be requested when enabled for this release.
Account and security storage
The application uses HttpOnly first-party boss-access and boss-refresh cookies for the signed-in session, currently set with a maximum browser lifetime of seven days. Tokens may expire or be refreshed earlier. Cookies use SameSite Lax and Secure in deployed environments. Clearing them or signing out affects access.
Temporary sign-in and recovery storage
boss-oauth-flow binds a requested OAuth sign-in for up to ten minutes. Requested email sign-in and recovery use boss-email-flow and boss-email-verifiers for up to fifteen minutes, and boss-reset-access, boss-reset-refresh and boss-reset-grant for up to ten minutes. These support requested account and security functions; they are not advertising preferences.
Other providers and diagnostics
Google sign-in opens a separate provider flow governed by that provider's notices. Google-hosted fonts make external network requests. Lovable preview authentication may use browser storage and editor messaging, and diagnostic hooks may report errors and page paths when installed. Hosting or provider technologies must be inventoried in the deployed environment before this notice is approved. This notice does not classify every provider technology as strictly necessary.
Choices
Browser settings can clear or block storage, which may prevent sign-in or recovery. Optional analytics or advertising technologies requiring consent must remain blocked until a separate valid choice is made. This release adds no optional-tracking consent banner or preference that purports to control third-party scripts it has not verified. Contact the privacy channel with questions about the deployed inventory.