Cookies & Tracking

Last updated: 13 May 2026

Overview

MC Territory Maps is a private, login-only application. We keep tracking to the minimum needed to run the service securely. We do not use advertising cookies, cross-site trackers, or sell any data to third parties.

Cookie categories

Strictly necessary (always on)

Used to keep you signed in, remember your two-factor authentication session, and protect against CSRF. These are first-party only and set by our authentication provider. The app cannot function without them, so they cannot be disabled.

sb-*-auth-token — session and refresh tokens (local storage / cookie)
sb-*-auth-token-code-verifier — PKCE verifier during login

Preferences

Small first-party items used to remember UI preferences such as the selected office filter or sidebar state. No personal data is shared.

Analytics

We collect minimal, aggregated server-side request metrics (route, status code, latency) to monitor reliability. No third-party analytics scripts (Google Analytics, Meta Pixel, Hotjar, etc.) are loaded in the browser, and no client-side analytics cookies are set.

Marketing

None. We do not run advertising or retargeting.

Third-party processors

The following sub-processors handle data on our behalf. All are bound by a data processing agreement and configured to keep data in the EU.

Supabase (via Lovable Cloud) — hosts the database, authentication, and file storage in AWS eu-west-1 (Ireland). Sets first-party session cookies / local-storage tokens to keep you signed in.
AWS (eu-west-1) — underlying infrastructure for compute, database, and object storage.
Cloudflare — edge network, TLS termination, and DDoS protection. May set a short-lived __cf_bm cookie for bot mitigation. No cross-site tracking.
Mapbox — renders the territory maps. When a map loads, Mapbox receives your IP address and the map tiles requested in order to serve them. See Mapbox's privacy policy for details.

How to opt out

Strictly necessary cookies: these cannot be disabled while using the app. Sign out to clear the session, or clear cookies and site data for this domain in your browser settings.
Preference cookies: clear site data in your browser to reset them.
Map tile requests: these only occur when you open a page that renders a map. Avoid those pages, or block the Mapbox domain at the network or browser level, if you do not want Mapbox to receive your IP.
Browser-level controls: all modern browsers let you block or delete cookies per-site. Enabling "Do Not Track" or Global Privacy Control is respected — we do not run advertising or cross-site tracking regardless.

Contact

Questions about cookies, tracking, or to exercise your data rights? Contact your administrator, or see the Privacy & Compliance page for data residency and retention details.