This Cookie Policy explains the cookies and similar technologies Hospo uses, what they do, and how you can control them. It supplements our Privacy Policy.
1. What are cookies?
Cookies are small text files stored on your device by your browser. We also use related technologies such as local storage. In this policy we refer to all of them as "cookies".
2. Your choices
When you first visit Hospo we ask whether you accept non-essential cookies. You can Accept all, Reject all, or Manage preferences by category. You can change your mind anytime by clicking Cookie preferences in the bottom-left corner of any page or in the footer.
Strictly necessary cookies are always on — Hospo cannot function without them.
3. Cookies we use
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| sb-access-token | Hospo / Supabase | Keeps you signed in | 1 hour (rotated) | Strictly necessary |
| sb-refresh-token | Hospo / Supabase | Refreshes your session | 1 year | Strictly necessary |
| hospo:cookie-consent:v1 | Hospo | Remembers your cookie choices | 6 months | Strictly necessary |
| hospo:anon-id | Hospo | Links your consent record to your visit for audit | 6 months | Strictly necessary |
| hospo:filters | Hospo | Remembers shift filters | 30 days | Functional |
| hospo:viewport | Hospo | Remembers map vs list preference | 30 days | Functional |
| _pa_* | Plausible | Privacy-friendly aggregated analytics (no cookies set) | Session | Analytics |
4. Third-party services
Google Maps is used to display address autocomplete and the shift map. It is loaded only after you reach a page that needs it and uses a public, referrer-restricted API key, not a tracking cookie.
Stripe is used for payments and may set its own cookies on its hosted checkout page — see Stripe's cookie policy.
5. How we record your consent
For each consent decision we store: the categories you allowed, the version of this policy you saw, the date and time, your user-agent and a one-way hash of your IP. We retain this for at least 5 years to satisfy GDPR Art. 5(2) accountability.
6. Re-prompting
We re-ask for consent every 6 months, or sooner if we materially change this policy.
7. Contact
Questions: privacy@hospo.dev.