Cookie Policy
We use only essential cookies — no advertising, no tracking, no consent banner.
Last updated: May 23, 2026
1. What Are Cookies?
Cookies are small text files a website stores in your browser to remember information between visits — for example, whether you are signed in. Some are strictly necessary for a service to function; others track behaviour for analytics or advertising. Starvo only uses the first kind for authentication.
2. What Cookies & Storage Starvo Uses
| Cookie / storage | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| sb-*-auth-token | Auth | Supabase | Keeps you signed in. Only present after you sign in. | Session; rotating refresh token |
| sb-*-auth-token-code-verifier | Auth | Supabase | PKCE code verifier during OAuth. Deleted after sign-in. | Login flow only (minutes) |
| google_oauth_state / google_oauth_business_id | Auth (CSRF) | Starvo | Protects the Google Business Profile OAuth connect flow. Cleared after callback. | Minutes (httpOnly) |
| Service worker / Cache Storage (PWA) | Technical cache | Starvo | Caches app-shell assets for offline resilience. Not used for advertising. | Until cache clears or the worker updates |
That is the complete list of Starvo/Supabase auth and technical storage we intentionally use. No advertising cookies, no analytics cookies, no third-party tracking pixels on our domain.
3. What Starvo Does NOT Use
No Google Analytics or GA4, no Meta Pixel, no Hotjar or session recording, no Mixpanel or Amplitude, no advertising or retargeting cookies, and no cross-site tracking pixels we control. Outbound third-party connections are to Supabase (auth + database), Dodo Payments (checkout), Groq (AI drafts you request), Resend (transactional email), Google (optional Business Profile OAuth), Meta (optional WhatsApp), and the web host/CDN that serves static assets.
4. Third-Party Cookies & Host Cookies
When you sign in with Google, or connect Google Business Profile, you are briefly redirected to Google's domain, where Google may set its own cookies under Google's policy. When you purchase a plan, you are redirected to Dodo Payments' checkout, where Dodo may set cookies under its policy. Your hosting/CDN provider may collect request logs (IP, URL) to deliver the site — those are not Starvo advertising trackers. When you return to starvo.app, we do not set cross-site advertising cookies on our domain.
5. Why There Is No Cookie Banner
Under the ePrivacy Directive (Article 5(3)) and GDPR Recital 47, cookies that are strictly necessary for a service the user explicitly requested do not require prior consent. Starvo's first-party auth cookies are of that kind, and we do not run advertising or analytics cookies — so we do not show a tracking consent banner.
6. Managing and Deleting Cookies
You can manage and delete cookies through your browser settings. Deleting the Supabase auth cookie signs you out. Clearing all site data for starvo.app removes local caches as well.
7. Contact & Related
Questions about cookies or our data practices:privacy@starvo.app. Related:Privacy·Security·Terms·Refund.
Disclaimer & Updates
These pages describe how Starvo operates as a product. They are not legal advice. We may update them; for material changes we notify signed-in users by email and/or post a notice on the site or in the dashboard. The date at the top of each page is authoritative.