Current uses
- Supabase authentication state in local storage so signed-in sessions can continue.
- Preview-only parent-frame messaging where the development environment supplies temporary authentication storage. This is not the production storage path.
- Session storage for a witness LinkedIn callback, keyed to OAuth state and removed after use. The raw invitation token is not sent to LinkedIn.
- A session-only presentation flag used by homepage media.
What is not currently used
The audit found no advertising, cross-site tracking or analytics identifiers. A generic sidebar component contains optional cookie support, but that provider is not mounted by the application and does not currently set a cookie.
Font files are served from the application bundle. Loading a page does not contact Google Fonts, fonts.googleapis.com or fonts.gstatic.com.
Why there is no banner
On the current implementation, storage is used only for requested service functionality or closely related security and continuity. We therefore do not show a consent banner that has no meaningful choice behind it. Transparency still matters, which is why this notice exists.
This conclusion must be re-audited before adding analytics, advertising, experimentation or other non-essential storage technologies. Any technology that requires consent must not be enabled until an appropriate choice mechanism exists.