Cookies and browser storage
These are the cookies and browser storage CommerceDwar uses. Each one is needed for the app to work or for something you turned on, so none of them can be switched off here. We don't use cookies for advertising or analytics, and we don't share them with anyone.
| Name | Set by | What it is for | How long |
|---|---|---|---|
sb-<project-ref>-auth-tokensplit into sb-<project-ref>-auth-token.0, .1, … instead when the session is too large for one cookie | Supabase Auth, our sign-in service, on our domain | Keeps you signed in: it holds your session's access and refresh tokens | The cookie may last up to 400 days (the library's default, the browser maximum); the session in it ends at sign-out, after 30 minutes without activity, or 12 hours after sign-in |
sb-<project-ref>-auth-token-code-verifier | Supabase Auth | Completes a Google sign-in, an email sign-in link or a password reset securely (PKCE), and is also written when you sign up: the one-time secret of whichever you started most recently | Removed when that sign-in completes through its emailed link or Google; a sign-up's secret, or one from a sign-in you never completed, stays until you next sign out (at most 400 days) |
sb-<project-ref>-auth-token-flow-<flow-id>-code-verifier | Supabase Auth | One per sign-in or sign-up you start (a Google sign-in, an email sign-in link, a password reset or a sign-up): that attempt's one-time secret, so only this browser can finish it. At most five are kept; starting a sixth drops the oldest | Until you sign out (at most 400 days); completing the sign-in does not remove it |
sb-<project-ref>-auth-token-flows-code-verifier | Supabase Auth | The list of the pending sign-in and sign-up attempts above — used to drop the oldest and to clear them all when you sign out | Until you sign out (at most 400 days) |
cd_last_active | CommerceDwar | Signs you out after 30 minutes without activity | 12 hours |
cd_cookie_notice | CommerceDwar | Remembers that you have seen this notice | Up to 400 days; on Safari (Mac, iPhone and iPad) about 7 days — Safari limits cookies written by a page's script to a week, so there the notice returns about weekly |
_vercel_jwt — preview sites only | Vercel, our host | Admits testers to preview sites behind Vercel's login | Vercel's setting |
Last updated 2026-10-25