Cookie Policy
This inventory was produced from a review of the deployed TAP website, its production source, browser storage, page resources, authentication, registration, payment, and transactional-email flows. Optional technology is off until consent.
Current inventory
| Name / provider | Purpose | Category | Duration | Party |
|---|---|---|---|---|
tap_privacy_consent_v1 (localStorage) | Saves selected categories, timestamp, GPC state, and policy version | Strictly Necessary | 180 days; renewed when changed | First party |
tap_consent_id (localStorage) | Anonymous identifier connecting consent events without using a full IP address | Strictly Necessary | Until browser storage is cleared | First party |
tap_session (localStorage; Supabase) | Keeps an authenticated player, captain, or administrator signed in | Strictly Necessary | Until sign-out, expiration, or storage clearing; tokens refresh while valid | First party storage / Supabase processor |
| Netlify request and security logs | Delivers the website, prevents abuse, and diagnoses failures | Strictly Necessary | According to configured operational retention | Third-party processor |
| Supabase Auth, Database, and Edge Functions | Accounts, registration, waiver evidence, rosters, schedules, scores, consent records, and privacy requests | Strictly Necessary | Session and record-dependent | Third-party processor |
| Stripe Checkout, payment and fraud-prevention technology, including Stripe-controlled cookies on Stripe pages | Securely processes registration payments, authentication, fraud checks, and refunds | Strictly Necessary when checkout is initiated | Varies by Stripe cookie and security purpose | Third party |
| Resend API | Sends transactional registration and administrative emails from TAP servers; no browser pixel is loaded by TAP | Strictly Necessary | Message and provider-log dependent | Third-party processor |
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | Optional branded typography | Functionality | Browser-cache dependent; no TAP cookie | Third party |
| TAP first-party page analytics (Supabase Edge Functions and Database) | After Analytics consent, records page path without query strings, referrer hostname, coarse device type, viewport range, timestamp, and anonymous consent identifier. It does not receive form contents, profiles, registrations, waivers, rosters, scores, or payment data. | Analytics | Operational analytics records: up to 13 months | First party / Supabase processor |
| Google Analytics / Tag Manager | Not installed or active | Analytics | None | None |
| Meta Pixel / TikTok Pixel / advertising or retargeting SDKs | Not installed or active | Advertising / Marketing | None | None |
| Heatmaps / session recording / nonessential chat widgets | Not installed or active | Analytics or Functionality | None | None |
How choices work
Strictly Necessary technology is always active. Analytics, Advertising/Marketing, and Functionality are off by default. Rejecting optional technology leaves the website usable. Withdrawing consent blocks future optional loading and removes recognized first-party optional cookies TAP can delete. Browsers and third parties control some third-party storage, which may also be removed through browser settings.
Global Privacy Control
When a supported browser sends a Global Privacy Control signal, TAP treats it as an opt-out of sale, sharing, targeted advertising, and the related analytics/advertising technologies for that visit. Those categories cannot be reactivated during that visit.
Change your choice
Open Cookie Preferences at any time. A material change or the 180-day expiration causes the banner to return.