Cookies and storage

1. What cookies and device storage are

A cookie is a small piece of text a website asks your browser to keep and send back on your next visit. Device storage (your browser’s local and tab storage) does the same for bigger things, like a dish you’re still imagining, but stays in the browser and isn’t sent to us with each visit. Your browser also keeps copies of files it has already fetched, like fonts and the intro’s pictures, so pages open faster. That’s its cache.

Everything Cravable keeps is for this site only. We don’t use advertising cookies, analytics or tracking pixels, and the only other companies’ code is Cloudflare’s check that you’re not a bot, on a few forms, and Sentry’s, which reports an error on a page to us (section 4). Nothing we keep follows you to other websites.

2. Your choice

On your first visit, a card asks once: Only essentials or Accept. Both buttons are the same size, and the site works either way.

• Only essentials keeps what the site needs to work. Your area, filters and the like last until you close the tab or the browser.
• Accept also remembers those choices on this device for up to 12 months.

We keep your answer for 12 months, then ask again. If we change what we keep in a way that matters (adding analytics, say), we ask again sooner. Until you answer, nothing is remembered beyond your visit.

To change your answer, use Cookie choices below, or Settings, then Privacy, then Cookies on this device. Moving to Only essentials clears what was remembered at once.

3. What we keep

Always on, because the site needs them

sb-…-auth-token

Keeps you signed in. Set by Supabase, our sign-in provider, on Cravable’s own address.How long: 90 days from your last visit, or until you sign out

sb-…-code-verifier, and two like it

Finish Continue with Google.How long: Until you’ve signed in, and at most [10 minutes]

cv-consent

Your cookie answer, the policy version and the day you answered. It also tells home you’ve been before, so the intro doesn’t play again by itself.How long: 12 months

cv-invite

An invite link you opened, so your friend gets their credit when you sign up.How long: Until you sign up, up to 30 days

cv-signed-out

Tells the next page to clear this device’s storage after you sign out.How long: 5 minutes

cv-human

That you passed Cloudflare’s check that you’re not a bot, so the dish guide and the AI search don’t ask again while you use them without an account.How long: 1 hour

cravable:imagine-draft (device storage)

The dish you’re imagining, with your conversation with the dish guide and the address you picked for it.How long: Until you send it or sign out, and at most [30 days]

cravable:account-address (device storage)

The address saved on your account and its point on the map, so Your address opens on it without looking it up each time.How long: Until you sign out, and at most 30 days

cravable:times, cravable:slot, cravable:portions, cravable:orders, cravable:address (tab storage)

The times, the orders you’d like, and the half hour, portions and address you pick while you sign in to join, reserve or order a crave.How long: Until you join, reserve or order, or close the tab

cravable_test_switch

Staff only: Cravable’s test tools. Never set for customers.How long: 12 hours

With Accept, on this device only. With Only essentials, or until you answer, these last only until you close the tab or the browser.

cv-region

The place you picked for the feed, to about a kilometer, never your exact spot, or that you picked the whole Bay Area.How long: 12 months from when it last changed

cv-filters

The feed’s stage and filters.How long: 12 months from when they last changed

cv-tastes, cv-tastes-asked

Your taste answers before you sign in (they move to your account when you do), and that we asked.How long: 12 months from when they last changed

cv-film

Play the intro on every visit, if you turned it on in Settings.How long: 12 months from when you set it

cv-rail

Kitchens and staff only: whether the kitchen console’s tabs are folded to their icons. Never set for customers.How long: 12 months from when it last changed

cv-searches (device storage)

Your 6 most recent searches.How long: Up to 12 months, while your answer lasts, or until you clear them

cv:mine-seen (device storage)

When you last opened My craves, for its news dot.How long: Up to 12 months, while your answer lasts

Signing out, or deleting your account, clears all of these on the device you’re using except cv-consent, so the next person on a shared device starts clean. Signing out signs you out on your other devices too, but their storage clears the next time they’re used.

4. Other companies’ cookies

• Google: when you use Continue with Google, you sign in on Google’s own page, and Google uses its own cookies there under its privacy policy. Cravable never sees your Google password.
• Supabase sets the sign-in cookies above, but on Cravable’s address and only for signing in.
• Cloudflare: Sign in, Create account, codes we email, a new password, the chef application, and the dish guide and AI search without an account check that you’re not a bot with Cloudflare Turnstile. Its script runs on those pages and looks at your browser and connection to tell people from bots, under Cloudflare’s privacy policy. It sets no cookies on Cravable’s address and isn’t used for advertising.
• Sentry: when something on a page breaks, its code, which comes with Cravable’s own, sends us a report of the error through Cravable’s address, so we can fix it. It also sends the note you write when you use Report a problem. It sets no cookies and keeps nothing on your device.
• Nobody else sets cookies through Cravable, and our emails don’t track whether you open them or click their links.

5. Caching

Caching means keeping a copy of something so it doesn’t have to be fetched again.

Pages and your account’s data

Never cached. Each page is made fresh for the person asking.

Scripts, styles, fonts and the intro’s pictures

Your browser and our host’s networkFor how long: Up to a year. Their names change when they do, so you always get the current one.

Dish pictures, kitchens’ photos and AI illustrations

Your browser and our storage provider’s networkFor how long: Up to a year

A shared crave’s preview picture

Our host’s networkFor how long: 5 minutes, so a shared link shows recent counts

My craves’ frame (not your craves themselves)

Your browser’s memoryFor how long: Up to a day, so the sheet opens at once

Cached copies hold no personal information except pictures that people can already see on Cravable. When an account is deleted, the pictures made for it that no crave still shows are deleted from storage, and the copies in networks’ caches expire on their own. To clear your browser’s cache, use your browser’s settings.

Cravable doesn’t install a service worker or keep an offline copy of the site on your device.

6. Do Not Track and Global Privacy Control

Global Privacy Control (GPC) is a setting some browsers send to ask sites not to sell or share your personal information. Cravable doesn’t sell or share personal information, or use it for advertising, so there’s nothing for the signal to turn off today. If we ever add analytics, a browser that sends GPC keeps them off, whatever you answered.

Do Not Track is an older signal with no agreed meaning. Cravable doesn’t track you across sites, so it works the same whether or not your browser sends it.

7. Changes and contact

We update this page whenever what we keep changes, and the date at the top with it. Questions: privacy@cravable.ai.