Cookie Policy

These are first-party cookies, set on our own domain by Supabase Auth, the service that signs you in. project-ref below is the identifier of our Supabase project.

sb-<project-ref>-auth-tokenNecessary

Holds your sign-in session so you are not asked to log in again on every page. Large sessions are split across numbered cookies with .0 and .1 suffixes.

sb-<project-ref>-auth-token-code-verifierNecessary

A short-lived value used during sign-in to complete the secure authorisation exchange, particularly for Google sign-in. Discarded once you are signed in.

Our own API server sets no cookies at all — it authenticates requests using a token sent in a header instead.

Most of what we store is not a cookie but local storage and session storage — data kept in your browser that is never automatically sent to a server. Session storage is wiped when you close the tab.

Local storage — kept until you clear it

gh_access_tokenNecessary

Your sign-in token. This is what authorises each request the app makes to our API. Removed when you sign out.

gh_push_opted_outPreference

Set when you turn browser notifications off, so we do not re-enable them.

gh_push_promptedPreference

Records that you have already been asked about notifications, so we do not ask twice.

gh_release_notes_versionPreference

The version of the release notes you last dismissed.

gh_release_notes_seen_atPreference

When you last dismissed the release notes.

ghc-ios-install-dismissedPreference

Set when you dismiss the “add to home screen” prompt on iOS.

Session storage — cleared when you close the tab

gh_sPreference

Marks that the opening splash animation has already played, so it does not replay on every page. This one is set on public pages too, including the page you are reading.

maintenance-banner-dismissedPreference

The maintenance notice you dismissed, so the same one does not reappear.

Preference keys all use a gh_ or ghc- prefix, contain no personal information, and are only ever read by this site.

• A service worker. The app installs one so it can be added to your home screen and receive notifications. It does not cache pages or store your data offline.
• A push subscription. If you allow notifications, your browser creates a subscription that we store on our server. Turning notifications off removes it.

One third-party script loads on every page of this site, including the public pages: the Google Maps JavaScript API. It is used inside the app so commissioners can look up a game venue, but it currently loads everywhere.

It does not set cookies on our domain, but loading it makes your browser contact Google, which receives your IP address and user-agent and may set or read cookies on its own domains under Google’s privacy policy.

If you sign in with Google, Google’s own sign-in script loads on the login page and Google sets cookies as part of that process.

Beyond these, no third-party script runs on this site. Fonts are served from our own domain, not from a font network.

• Every browser lets you view and delete cookies and site data for a single site — usually under Settings → Privacy, or by clicking the padlock in the address bar.
• Signing out clears your sign-in token and ends the session.
• Notifications can be turned off in Profile → Settings inside the app, or in your browser’s site permissions.
• Clearing site data will sign you out and reset your dismissed banners. Nothing else is lost — your profile, statistics and messages live on the server.

Blocking the necessary cookies above will prevent you from signing in at all. There is no way around that.

We show no consent banner because we set nothing that would need consent: no analytics, no advertising, no cross-site tracking. What remains is strictly necessary for sign-in, plus preferences you set yourself.

This is a local basketball league in New Jersey and we do not target visitors in the EU or UK. If that changes we will add a consent banner before it does.

This page sits alongside the Privacy Policy, which explains what we do with the information behind these keys.

Anything unclear: [email protected].