Cookies and storage

_AI draft_

Confirmed: no cookie banner is needed today. Everything below is either strictly necessary for something you asked for, or set only after you tick a box (PECR reg 6(4)(b); ICO cookies guidance). We use no analytics, advertising or tracking cookies.

| Name / key | Where | What it does | Type | How long | |---|---|---|---|---| | Device code (ro.) | Guest phone, browser storage | Keeps your orders and bill together | Strictly necessary | Until you clear your browser | | Table join, pickup and booking saves (ro.) | Guest phone | Remembers your open order or booking so you can cancel it | Strictly necessary | Until used or cleared | | "Remember me on this phone" (booking contact) | Guest phone only | Fills in your name and phone next time | Set only if you tick it | Until you untick it or clear your browser | | "Remember me here" | httpOnly cookie, that restaurant only | Welcome-back offer | Consent (your tick) | 12 months | | Sign-in (Supabase auth) | Owner, staff and admin devices | Keeps you signed in | Strictly necessary | Session | | Screen settings (ro-theme, kitchen mode, sounds) | Staff/owner devices | Remembers display settings | Strictly necessary (preference you chose) | Until changed | | Sentry error reports (only if switched on) | All pages | Reports crashes so we can fix them; no IP stored, no session recording | Strictly necessary for security / service (lawyer Q15) | 30-90 days at Sentry |

Rule. Adding analytics, pixels, chat widgets or session recording = the legal reviewer checks first, and a consent tick or banner is added if needed. The 2025 UK rules (Data (Use and Access) Act 2025) allow some statistics cookies without consent if users are told and can opt out easily; we will use that only after review.