Cookie Policy

Cookies are small text files stored by your browser. We use them to remember selected preferences and to keep authenticated users signed in while they use protected parts of SnackStreak such as the dashboard and billing pages.

Optional analytics and marketing storage is off by default. We do not currently load an analytics or advertising provider, but the consent system blocks those categories until a visitor has actively allowed them.

The session cookies are created server-side after a Firebase identity token is verified. They are used to maintain access to protected routes such as dashboard, billing, and related API requests. In the current code, these cookies are configured with an expiry of up to five days, path /, SameSite=Lax, and Secure in production.

The userToken cookie is written from the client during auth flows so the app can keep browser auth state and server session creation in sync. It is cleared when a user logs out.

Optional storage, including the newsletter or discount popup dismissal key, is only used after consent for the relevant category. Rejecting or withdrawing marketing consent removes that popup key.

You can accept all optional storage, reject non-essential storage, or choose categories individually. Necessary storage cannot be disabled inside SnackStreak because it is required for security and requested services.

• You can delete or block cookies from your browser settings at any time.
• If you block authentication storage, you may not be able to sign in or use protected dashboard and billing areas correctly.
• On shared devices, signing out after use is recommended so session-related browser data is cleared promptly.

SnackStreak integrates with external services such as Firebase for authentication. Some third-party providers may apply their own browser storage, security mechanisms, or cookies when their services are involved. Their own privacy and cookie documentation will apply to those provider-controlled technologies.

Google/Firebase Analytics, advertising pixels, and other optional tracking scripts are not initialized in this version of the app. If they are added later, they must be loaded through the consent gate and remain blocked until the matching category is accepted.