Cookie Policy
Effective date: September 28, 2026
Cookies are small browser records sent with web requests. Local storage keeps information in your browser without automatically attaching it to each request. We use necessary authentication and security technology and offer separate choices for optional analytics and Google Maps. See our Privacy Policy for how we handle personal information.
Technologies used here
| Technology / provider | Purpose and category | Duration |
|---|---|---|
sb-<project-ref>-auth-token, sometimes split into numbered chunks such as .0 and .1. Supabase; first-party cookies. | Necessary: hold authentication/session information for sign-in and protected pages. | The installed library sets a maximum age of 400 days on writes. Browser limits and actual session validity can be shorter. Cookies are refreshed and removed during session handling/sign-out. |
Supabase cookies based on the same name with -code-verifier, -flow-<id>-code-verifier, or -flows-code-verifier when its sign-in flow needs them. | Necessary: verify an authentication flow. These are conditional, not cookies every visitor receives. | Normally cleared as the flow completes or is cleaned up; the library's default cookie maximum age is otherwise 400 days. |
| Cloudflare Turnstile security script and challenge state on RSVP/contact forms. | Necessary: detect automated abuse. A cf_clearance cookie can be used if Cloudflare pre-clearance is enabled; this application does not enable that setting itself. | Challenge state is temporary. Any clearance-cookie duration depends on Cloudflare configuration; no fixed duration is asserted here. |
ccc-privacy-preferences-v1. Charm City Culés; first-party local storage, not a cookie. | Necessary preference record: remembers your optional-service choices. | Choices expire after 180 days and are then ignored until renewed. The stored entry may remain until replaced or cleared in your browser. If storage is blocked, choices last only in the current page visit. |
| Vercel Web Analytics; no analytics cookies. | Optional analytics: public-page audience measurement in production, only when allowed. | Vercel describes a request-derived visitor hash discarded after 24 hours. This is not a statement that all analytics records are deleted after 24 hours. |
| Google Maps embedded content and any Google cookies/storage. | Optional third-party map: loads only when allowed. Google may receive request data and read or set cookies. | Google controls names and durations, which can vary with browser/account settings. See Google's cookie information. |
We have no advertising SDK or marketing-tracking integration of our own. The optional Google embed is a separate third-party service with its own cookie practices. Social links do not embed social tracking widgets. This app does not use session storage for site preferences.
Your saved choices apply to this browser. You can change them here at any time.
Managing your choices
Optional services are off until you allow them. “Necessary only” keeps authentication and bot protection available. “Allow Google Maps” in the venue section permits the map without enabling analytics. Return here using the footer's Privacy settings link to change your choices. Choices apply to this browser and site origin, not automatically across devices or environments.
Withdrawing permission stops new analytics events or removes the map. An analytics script already loaded can remain until you refresh the page; it checks your choice before sending events. Withdrawing does not remove a provider's existing cookies or previously received data. Use your browser's site-data settings to view or clear cookies and local storage, or to restrict third-party cookies. Blocking authentication cookies can prevent sign-in; blocking security scripts can prevent form submission.
More information: Vercel Analytics privacy and Cloudflare Turnstile privacy.