Cookie Policy

Cookies We Use

MainStreetLens uses a minimal set of cookies and storage mechanisms. Below is exactly what we use and why.

Strictly necessary cookies are essential for the MainStreetLens app to function. Without them, you cannot sign in or use the platform. The primary cookie is the Supabase auth token, which includes both a session token and a refresh token that keep you securely signed in. The session token expires quickly for security, while the refresh token keeps your session alive until you log out or it expires after up to one year. These cookies are set automatically when you sign in, marked as Secure to ensure they are only sent over encrypted HTTPS connections, and marked as HttpOnly to prevent JavaScript from reading them, which protects against cross-site scripting attacks. Under the GDPR and ePrivacy Directive, these cookies do not require your consent because they are strictly necessary for the service you have requested. You can delete these at any time by logging out of your account.

Analytics storage — We use Mixpanel to understand how visitors interact with MainStreetLens. This helps us identify what's working, what isn't, and where we can improve the user experience. Mixpanel uses localStorage rather than HTTP cookies, but it serves the same function and is treated as a tracking technology under EU law. The stored data tells us what features are used and how often, not who you are personally. We do not sell your data, and we do not use Mixpanel for advertising, profiling, or tracking you across other websites. No third-party cookies are set via Mixpanel on the MainStreetLens domain. The retention period is up to two years per Mixpanel's default retention. Under the GDPR, we need your consent to use Mixpanel analytics, and a cookie consent banner will be presented to EEA and UK users before Mixpanel is activated.

Third-party services — When you sign in using your Google account, Google may set transient cookies during the authentication redirect flow, such as .google.com cookies for security and single sign-on. These are set by Google, not by MainStreetLens, and they disappear after the login flow completes. They are governed by Google's own privacy policies. For details about Google's cookie practices, see Google's Privacy & Terms page.

Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, legal requirements, or other factors. When we make a material change, we will update the "Last Updated" date at the top of this policy and notify you through the Services or via email for significant changes. We encourage you to review this page periodically.