§ Legal
Cookie Policy
Last updated: September 28, 2026
1. What Are Cookies
Cookies are small text files a website stores on your device. Websites can also keep data in your browser's local storage. This policy lists everything Box Mate stores on your device and why.
2. Cookies We Use
Box Mate sets only the cookies below. We do not use advertising, tracking or analytics cookies, so we do not ask for cookie consent.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| sb-*-auth-token | Keeps you signed in (Supabase authentication session). Large sessions are split into sb-*-auth-token.0, .1, and so on. | Up to 1 year, removed when you sign out | Strictly necessary |
| sb-*-auth-token-code-verifier | Protects the sign-in and password-reset links (PKCE). | Session | Strictly necessary |
| NEXT_LOCALE | Remembers the language you chose (Portuguese, English or Spanish). | 1 year | Preference |
The authentication cookies are strictly necessary: without them you cannot sign in. The language cookie only remembers a choice you made. Under the ePrivacy rules neither needs consent.
3. Local Storage in Your Browser
The web app also keeps some data in your browser. It stays on your device and is not sent to anyone else.
| What | Details | How long |
|---|---|---|
| Your session | A copy of your signed-in session and role, so pages open without waiting, and the time of your last activity, used to sign you out after inactivity. | Removed when you sign out |
| Recently loaded data | The web app keeps a copy of recent data it loaded (in its service worker cache) so it still opens when the connection drops. | Removed when you sign out |
| Preferences | Light or dark theme, colour theme, sidebar pinned, the time before automatic sign-out, notification sound, whether the dashboard shows the countdown to the next class, and how you last left some screens (for example the planner view). | Stay on this device until you clear them |
| Drafts and offline actions | An email you are still writing, and actions made without a connection (such as check-ins) waiting to be sent. | Until sent or discarded |
| Within one tab | Short-lived choices such as the members selected for a campaign or a notice you already dismissed (session storage). | Until you close the tab |
On a shared computer, always sign out when you finish. The mobile app keeps similar data on your phone, removed when you delete the app.
4. Third Parties
Box Mate does not set third-party cookies and does not use Google Analytics, Facebook Pixel or any other tracking service. Two pages involve another company:
- Box sign-up: a Cloudflare Turnstile check stops automated sign-ups. Cloudflare receives your IP address and browser details for that check.
- Subscription payment: box owners pay on Stripe's own checkout page, which sets Stripe's cookies under Stripe's privacy policy.
The web app's fonts are served by Box Mate itself, and our emails load their fonts from our own storage, so opening a page or an email does not contact Google.
5. Managing Cookies
You can block or delete cookies and site data in your browser settings. If you block the authentication cookies you will not be able to sign in, and clearing site data also removes the preferences and unsent drafts listed above.
6. Changes to This Policy
We update this page whenever we add a cookie or change what we store. If we ever introduce cookies that need consent, we will ask for it before setting them.
7. Contact
For questions about cookies or your data:
CodeView, Lda
Email: privacy@box-mate.com
See also our Privacy Policy and Terms of Service.