Cookies & Local Storage

The short version

Grabbovoi uses browser storage for authentication, subscription state, and product preferences. We do not use tracking cookies, advertising pixels, or third-party analytics that profile you across the web. Your trade data, P&L, balances, and Supabase user ID are never written into an analytics or tracking payload.

Cookies we set

Authentication (Supabase)

When you sign in, Supabase sets an authentication cookie (usually sb-*-auth-token) scoped to .grabbovoi.com. It is HTTP-only, Secure, and SameSite=Lax. Its only purpose is to keep you signed in as you navigate. We do not read it in any analytics or tracking context.

Subscription state (Whop license cookies)

When you activate a paid plan we set mogul_license and mogul_license_valid so we can gate paid features without a round-trip to Whop on every page. They contain your license key hash and a validation flag — never your card, address, or Whop identity.

Device tracking (Active Devices)

We set an mg_session cookie to record the device+browser you're signed in from, so you can see the list under Settings → Active Devices and revoke a device you no longer control. The cookie only stores an opaque identifier; the actual device metadata lives server-side.

Referral capture (optional)

If you land on the site via a ?ref=CODE link, we stash the code in a 30-day cookie so the referring user is credited when you subscribe. If you don't arrive via a referral, no such cookie is set.

What we store in localStorage

localStorage keeps product state that must survive a page refresh but doesn't need to sync across your devices. Keys are prefixed grabbovoi_(some legacy mogul_ keys still exist during the migration window). Categories:

• Theme & accessibility: the color accent, light/dark mode, text size, Read-Aloud voice preference.
• Trading workspace preferences: your typed account balance, your recent-days watchlists (last 60 days), pre-market checklist completion for recent days.
• Academy progress: daily-challenge progress by date (last 90 days), completed topics, game unlock state, streak counters.
• Feature flags & onboarding: whether you've dismissed specific hint cards, chosen a skill level, or completed one-time tutorials.
• Legacy archive: a single grabbovoi_legacy_archive_v1key holding a compressed backup of your pre-migration keys, in case a feature needs to restore the old shape. See Settings → Data Management → "Restore Legacy Data".

What we do NOT store client-side

• Your trades, P&L, or balances — those live server-side in your Supabase rows and are pulled per view.
• Your card number or billing address — Whop handles all payment data.
• Your Discord username, real name, email address, or IP address for tracking purposes.

Server-side telemetry

We collect two categories of server-side telemetry, both scoped narrowly:

• Web Vitals (/api/perf/vitals): Core Web Vitals numbers (LCP, CLS, INP, TTFB) and the pathname you were on. This lets us diagnose performance regressions. The endpoint strictly rejectsany payload that carries a Supabase user ID, a P&L number, or a trade field. It is not shared with advertisers or third-party analytics networks.
• Discord avatar proxy (/api/avatar/discord): when another user has opted into showing a Discord photo, our server fetches the image from cdn.discordapp.com and re-serves it to your browser from our own origin. This means your browser never contacts Discord on our behalf. The endpoint caches responses for 24 h and only accepts well-formed Discord user IDs + avatar hashes.

Managing your storage

• Sign out from Settings → Account to invalidate the auth cookie and, if you check "sign out of all devices", every session tied to your account.
• Clear browser storage in your browser settings to remove every cookie and localStorage key we set. You will need to sign in again.
• Change accent, theme, text size, or Read-Aloud voice in Settings — those flip the underlying localStorage keys.

Contact

Questions about what we store in your browser? Email support@grabbovoi.com.