Just two cookies.

The two cookies we set

Both come from Supabase, the sign-in service we use, and both are first-party: they belong to littleweave.app and are sent nowhere else.

• sb-wpbwvrrtotzrktbthyyu-auth-token — keeps you signed in. Set the moment you sign in and removed when you sign out. If it grows too big for one cookie your browser holds it in numbered parts (…auth-token.0, .1). It is written with the longest expiry a browser allows (400 days) and refreshed as you use the site, so on your own device you stay signed in until you sign out. We need it.
• sb-wpbwvrrtotzrktbthyyu-auth-token-code-verifier — a one-time code set when you ask for a sign-in link, create an account or reset your password, so the link in your email can only finish signing you in from the browser that asked for it. It has no other use, and it is cleared when you sign out.

You may also see one cookie that is not ours: _vcrcs, set by Vercel, the company that hosts the site, for about an hour if its bot protection needs to check that a visit comes from a real browser. We don’t set it and we don’t read it.

What we don’t have

No Google Analytics. No Meta pixel. No Hotjar, Mixpanel, Segment, Amplitude, FullStory or session recording of any kind. No remarketing pixels. This is a product that holds recordings of children — there is no version of us that puts ad trackers next to that.

Visitor counting, without a cookie

We count visits to the public pages — the home page, the prompts archive, the comparison pages, and pages like this one — with Vercel Web Analytics. It is cookieless: it sets nothing in your browser, so the list above is unchanged. What it records, in aggregate, is the page visited, where you came from, your country and the kind of device — never a name or an email. It does not record any signed-in page. Nothing about your recordings, your children or your family is ever sent to it.

Local storage we do use

A few things live in your browser’s own storage rather than in cookies. Unlike cookies they are never sent to us with a request; they exist only so the app works well on your device.

• littleweave_profile_cache, littleweave_children_cache and littleweave_active_child— a copy of your profile, your children’s names and which child you last had open, so the app opens straight away, even offline. All three are cleared when you sign out.

If you record offline — at the foot of the bed with no signal — your audio and a sync queue live in your phone’s local storage (a small database called littleweave) until we can sync them up. That data leaves the moment sync completes.

Your choice

Both cookies exist only to sign you in, so there is nothing to opt out of: block them and the public pages still work, you just can’t stay signed in. There is no “accept all” banner because there is nothing worth a banner to accept.