Cookies
Cookie Policy
Last updated: September 15, 2026
What cookies are
Cookies are small files a site saves on your device to remember information between one visit and the next.
The cookies I use
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sb-<project>-auth-token | Technical, necessary | 400 days | Keeps you signed in after you sign in (with email, password or Google), without asking every time. If the content is too large for a single cookie, it's split across multiple cookies with the same name followed by .0, .1 and so on: they're still part of the same single session cookie. |
| sb-<project>-auth-token-code-verifier | Technical, necessary | 400 days | Used only while signing in with "Sign in with Google", to securely complete the handoff from Google to CartolinaLenta. It is normally removed as soon as sign-in completes, but if the handoff is interrupted halfway it stays in the browser for as long as the other sign-in cookies. |
| locale | Technical, necessary | 1 year | Remembers the app's language (Italian or English): either the one you explicitly chose from the language picker, or the one detected from your browser on first visit if you haven't chosen one yet. Never silently overwritten once you've made an explicit choice. |
| cl_has_received_postcard | Analytics, optional | About 2 years | Set only if you accept analytics, the first time you open the link to a postcard you received: remembers that this browser has already opened one, so I can count how many people receive a postcard for the very first time. Holds nothing beyond that fact. |
| cl_referral_postcard_id | Analytics, optional | 30 days | Set only if you accept analytics, when you open a postcard's link: holds that postcard's id, so if you register within 30 days I can tell the registration came from there. Deleted right after the first registration that reads it, or after 30 days if you never register. |
The first three are strictly necessary for the app to work (the first two are set by the authentication system I use, Supabase; the third one I set myself) and don't require consent under applicable regulation (art. 122 of the Italian Privacy Code and the Garante's guidelines on technical cookies): none of them are used to profile you or track you across other sites. The real name, in place of <project>, contains a Supabase project identifier: it's not a secret (the same identifier is already visible to anyone inspecting the site's network requests), but it changes if the Supabase project is ever recreated.
Not a cookie, but for completeness: your choice to accept or decline analytics (below) isn't saved in a cookie, but in your browser's local storage (localStorage) on your own device — same logic, same control on your end, different technology.
Analytics
If you accept, I use PostHog (PostHog Inc., with servers in the European Union) to understand which parts of the app actually get used. PostHog writes no cookies: it keeps its identifier in the browser's local storage, which clearing the site's data removes. I use no other analytics tool, and there is no advertising at all.
Two more events, for completeness. When a postcard you sent is notified to its recipient, I record the event against you (the sender, if you accepted analytics) — never against the recipient: whoever receives a postcard has often never used the app or accepted anything, so I don't treat them as if they had. And if you open a postcard you received and then register within 30 days (see the cl_has_received_postcard and cl_referral_postcard_id cookies in the table above), I link the registration to that postcard — only ever if you, as the recipient, accepted analytics on this same page before registering. These two events stay in PostHog only.
How to manage cookies
You can delete or block cookies from your browser settings. If you block the session cookie, you won't stay signed in between visits and will need to sign in again each time. If you block only the PostHog ones (or decline from the banner or above), the Service works exactly the same way: those cookies aren't needed to use the app, only to measure it.
Changes to this policy
If the app were to use additional cookies in the future, this page will be updated before they're set.