Part 2. ChainPass Cookie and Device Storage Notice
Effective date: [OPEN].
ChainPass uses only storage that the site needs to work. ChainPass uses no advertising cookies, no analytics cookies and no third-party tracking. Because every item below is strictly necessary or set by your own choice, no consent banner is shown. If ChainPass adds analytics later, this notice changes first and you will be asked.
| Name | Type | Set by | Purpose | Lasts |
|---|---|---|---|---|
sb-…-auth-token | Local storage | ChainPass (Supabase) | Keeps you signed in | Until you sign out |
Enrolment step values (session_id, verification_session_id, terms_accepted, vai_number, contact fields and similar) | Session storage | ChainPass | Carries your place through enrolment | Cleared when the tab closes |
chainpass_remember_vai | Local storage | ChainPass, only if you tick "remember on this device" | Pre-fills your V.A.I. number on this device | Until you untick it or clear the browser |
enrolment_vai_shown | Local storage | ChainPass | Records that your number screen was shown | Until you clear the browser |
i18nextLng | Local storage | ChainPass | Your language | Until you clear the browser |
theme | Local storage | ChainPass | Light or dark mode | Until you clear the browser |
pwa-banner-dismissed, pwa-install-dismissed | Local storage | ChainPass | Stops the install prompt reappearing | Until you clear the browser |
| Stripe fraud-prevention cookies | Cookie | Stripe, on the payment page only | Fraud prevention for card payments | Set by Stripe [OPEN item 8] |
Your V.A.I. number stored on your device is never sent to a platform by this storage. You can clear all of it in your browser settings. Signing out and clearing storage will not delete your V.A.I.
Build notes for counsel and the build team (not for publication):
1. The ChainPass shell bundles a sidebar component that would set a sidebar:state cookie. No page uses it today. If the dashboards start using it, add a row.
2. Enrolment keeps email, phone and V.A.I. number in session storage. That is lawful as strictly necessary, but a shared device keeps them until the tab closes. Consider clearing them at the handoff.
3. The chainpass.io marketing page was checked live on 9 Oct 2026. No trackers were visible in the fetched content, but the fetch does not show page scripts. Confirm the deployed <head> before publishing.