Cookies & browser storage
Small records. Specific purposes.
CocktailSteps uses browser storage to keep accounts secure, remember the bar inventory a visitor chooses, and avoid repeating the age question within the same browser session. It also remembers when a visitor dismisses the free AI announcement. Cloudflare also injects a cookie-free performance beacon on the production site. On limited eligible pages, consent management and advertising technology may also be used as described below.
Effective August 20, 2026
What we use today.
| Technology | Information handled | Purpose | Typical duration |
|---|---|---|---|
| Session storage | cocktailsteps.age-confirmed:v1 = true | Records a visitor's legal-drinking-age self-confirmation for the current tab or browser session. It is not linked to an account or sent to our servers. | The current tab or browser session, subject to the browser's session-restore behavior. |
| Local storage | cocktailsteps.inventory, containing ingredient identifiers selected by the visitor. | Remembers a confirmed bar inventory for recipe matching and, when requested, AI Coach context. | Until the visitor changes it or clears browser storage. |
| Local storage | cocktailsteps.free-ai-banner-dismissed:v1 = true | Remembers that a visitor dismissed the current free AI announcement. It is not linked to an account or sent to our servers. | Until the visitor clears browser storage. |
| Local and session storage | cocktailsteps.ad-request-opt-out:v1 = true and a short-lived cocktailsteps.open-privacy-choices:v1navigation flag. | Enforces the visitor's stricter site-level block on new ad requests and carries an explicit request to open Google's privacy manager to an eligible page. Neither value is linked to an account or sent to our servers. | The opt-out remains until changed or local storage is cleared; the navigation flag is consumed immediately or ends with the browser session. |
| Supabase authentication cookies | Session and refresh information; cookie names may be split. | Signs a visitor in, refreshes the account session, and protects authenticated features. | Until sign-out, session expiry, or deletion under the account security configuration. |
| Cloudflare Turnstile | Short-lived verification tokens and browser security signals. | Protects password sign-in and account creation from automated abuse. | Short-lived verification and the security periods described by Cloudflare. |
| Cloudflare Web Analytics performance beacon | Page path, referrer, browser, operating system, device category, country, navigation timing, Core Web Vitals, and a page-load identifier generated in browser memory. The beacon does not use cookies, local storage, session storage, or browser fingerprinting. | Measures aggregate site use and real-user page performance. It is not used for advertising personalization or to follow an individual across websites. | Browser state is ephemeral. Cloudflare controls provider-side retention under its published Web Analytics limits. |
| Google Privacy & Messaging | Consent or objection choices, applicable TCF signals, and the limited technical information needed to present and secure the consent message. | Presents required advertising choices, communicates them to participating vendors, and allows a visitor to withdraw or change a choice. | Until the choice expires, changes, is withdrawn, or its browser record is cleared, subject to the CMP configuration. |
| Google AdSense | Page and referrer context, IP address, browser and device characteristics, coarse location inferred from IP address, ad requests, impressions or interactions, fraud signals, and cookies or browser identifiers where allowed. | Delivers and measures manually placed ads, manages frequency, and protects against invalid or abusive activity after the applicable age and privacy conditions are satisfied. | Varies by technology, region, visitor choice, and Google's settings and policies. Optional identifiers can be cleared or blocked through the controls below. |
When optional advertising technology loads.
Ads are limited to eligible Explore and non-zero-proof recipe pages and are not allowed before the visitor confirms legal drinking age. In the European Economic Area, United Kingdom, and Switzerland, CocktailSteps uses a Google-certified CMP supporting the IAB Transparency and Consent Framework v2.3. No programmatic ad request is made before consent, or after rejection or withdrawal.
The CMP may process the minimum technical information needed to present and remember the privacy message; that is separate from sending an ad request. A supported Global Privacy Control signal suppresses programmatic ad requests. Rejecting advertising does not disable the site's core features.
CocktailSteps also uses limited first-party server-side product metrics described in the Privacy Policy. Those records do not set a browser identifier, cookie, or analytics storage key.
Cloudflare Web Analytics is separate from advertising choices. Its production performance beacon runs without cookies or persistent browser storage and measures aggregate use and Core Web Vitals; it does not personalize ads. Because Cloudflare injects it at the network edge, this non-ad beacon may load before the visitor answers the age prompt. It does not send or authorize an advertising request. A browser or content blocker may block the beacon without disabling CocktailSteps' core features.
Your controls.
Browser settings can clear or block cookies and site storage. Clearing authentication cookies signs you out. Clearing local storage removes the saved inventory and resets the free AI announcement preference. Clearing session storage causes the age question to appear again.
Use Privacy choicesin the site footer at any time to review, reject, or withdraw an advertising choice. A browser's Global Privacy Control setting is also honored for programmatic advertising. Clearing the CMP's stored choice may cause the consent message to appear again. Browser settings and content blockers can additionally clear or block optional cookies, storage, and advertising scripts.
Blocking essential storage may prevent sign-in or other requested features from working. Blocking optional advertising technology does not prevent access to core content and features.
Third-party technology.
Cloudflare Turnstile loads on the sign-in page and may process network and browser signals before an age answer is submitted. CocktailSteps uses it only to protect account access; Cloudflare may also process signals to improve bot detection as described in the Turnstile Privacy Addendum.
Google's advertising and consent technologies operate under Google's Privacy Policy and advertising technologies notice. Their storage and retention can vary by region, choice, technology, and provider configuration; this notice does not assign a universal Google retention period.
Third-party vendors, including Google and Google-certified ad networks, may place or read cookies, or use web beacons, IP addresses, and other identifiers, when an ad is served. Google and its partners may use advertising cookies to select ads based on a visitor's prior visits to CocktailSteps and/or other sites, where the visitor's choice and law allow it. Visitors can manage or opt out of personalized advertising in Google's Ads Settings, review how Google uses information from partner sites and apps, and see Google's certified third-party advertising vendors.
On the production site, Cloudflare automatically injects the Web Analytics performance beacon. It loads from static.cloudflareinsights.comand reports real-user performance through Cloudflare's RUM endpoint without reading or writing browser storage. Because it is injected at the network edge, this non-ad, cookie-free performance beacon may load before the visitor answers the age prompt; it does not send or authorize an advertising request. Cloudflare documents the technology in its Web Analytics data-collection notice.