Sub Crawl
Cookies and Local Storage
The short version
Sub Crawl sets no cookies of its own. It keeps a small amount of data in your browser’s local storage so the app works: your crawl plan, your punches and scores, which live crawl you’re in, and (only if you sign in) your sign-in token. All of it exists to do the thing you asked the app to do. Nothing is used for advertising or to track you across other websites, which is why there’s no cookie banner.
This page lists every item, what it’s for, how long it lasts and how to clear it. Sub Crawl is run by one person in Glasgow; questions to playsubcrawls@gmail.com.
What is stored in your browser
“Local storage” and “session storage” are places a website can save data in your browser. Unlike cookies they are not sent to any server automatically; the app reads them itself when it needs to. Everything below is kept on your device only, except where the row says otherwise.
| Name | Type | Purpose | Lifetime | Strictly necessary? |
|---|---|---|---|---|
subcrawl.plan.v3 |
localStorage | Your current crawl plan: the stations, pubs, drinks and rules you picked. Lets the app work offline and remember your crawl when you come back. Stays on your device unless you choose to save or share it. | Until you press “Start a new crawl” or clear your browser data | Yes |
subcrawl.run.v3 |
localStorage | Your progress on that crawl: which stops you’ve punched and the scores you’ve entered. Device only. | Until you press “Start a new crawl” or clear your browser data | Yes |
subcrawl.live.session.v1 |
localStorage | Which live crawl (room) you’re currently in, so the app can rejoin it if you close the tab or lose signal underground. | Until you leave the live crawl, start a new crawl or clear your browser data | Yes |
subcrawl.live.queue.v1 |
localStorage | Scores you’ve entered in a live crawl that haven’t reached the server yet (for example, because you had no signal). They’re uploaded when you’re back online and then removed. | Until each score uploads successfully; otherwise until you clear your browser data | Yes |
sb-<ref>-auth-token |
localStorage | Your sign-in token, set by our database and sign-in provider (Supabase) only after you sign in. It keeps you signed in and is sent to Supabase to prove it’s you. “<ref>” is a fixed code identifying our Supabase project, not you. | Until you sign out or clear your browser data; the token itself is refreshed automatically while you stay signed in | Yes (only exists if you chose to sign in) |
sb-<ref>-auth-token-code-verifier |
localStorage | A one-time secret that proves the Google sign-in that comes back to us is the one you started. | Removed as soon as sign-in completes | Yes (only during Google sign-in) |
subcrawl.pendingName |
sessionStorage | Holds the display name you typed for a few seconds while you’re sent to Google to sign in and back again, so we can attach it to your account when you return. | Removed as soon as you return from Google; gone in any case when the tab closes | Yes (only during Google sign-in) |
__cf_bm / cf_clearance (or similar) |
HTTP cookie (third party: Cloudflare) | The site is hosted on Cloudflare Pages. On some requests Cloudflare may set a short-lived cookie to tell real visitors apart from bots and to protect the site from abuse. Sub Crawl doesn’t read it and it isn’t used to identify you to us. | Typically 30 minutes for __cf_bm; up to a year for cf_clearance if it is ever set |
Yes (security) |
That’s the whole list. There are no analytics cookies, advertising cookies, social-media cookies or fingerprinting.
Third-party requests
When you use Sub Crawl your browser may also talk to a few other services. None of them set cookies for Sub Crawl or track you across sites, but you should know they exist:
- Cloudflare (
sub-crawl.pages.dev) hosts the website. Every page you load is served by Cloudflare, who keep standard short-term technical logs (such as IP addresses) to run and protect the service. See the bot-protection cookie above. - Cloudflare Web Analytics is not currently enabled. If we switch it on it will be cookieless: it sets no cookies, stores nothing in your browser and uses no fingerprinting, so it cannot recognise you between visits, and we will update this page first.
- Supabase (database and sign-in, hosted in London) is contacted when a page opens (one anonymous page-load count that carries no identifier, see the Privacy Policy) and when you sign in, host or join a live crawl. The
supabase-jslibrary is served from Sub Crawl itself, so loading the library does not contact a separate CDN. - Google is involved only if you choose “Sign in with Google”. The sign-in itself happens on Google’s own pages under Google’s cookie and privacy rules; Sub Crawl doesn’t embed any Google script.
- Chart.js is served from Sub Crawl itself and used only on the admin dashboard page, which is visible to the site owner and nobody else.
- Buy Me a Coffee is an ordinary outbound link. Nothing from Buy Me a Coffee is embedded in Sub Crawl; if you tap the tip button you leave for their website, which has its own cookie policy. See our Tips and refunds page.
Fonts are served from our own site, not from a font provider, so no font-hosting service sees your visit.
Why there is no cookie banner
UK law (the Privacy and Electronic Communications Regulations, alongside UK GDPR) says a website needs your consent before storing or reading information on your device unless that storage is strictly necessary to provide a service you have asked for. Cookieless analytics that store nothing on your device and use no persistent identifier fall outside the consent rules altogether.
Everything Sub Crawl stores is in the first category: the plan and progress you built, the live room you joined, the scores waiting to upload, and the token that keeps you signed in after you chose to sign in. Cloudflare’s bot-protection cookie exists purely to keep the site up and secure. So there is nothing to ask consent for, and we’ve chosen not to show a banner that would only get in your way.
If that ever changes, for example if we added a tool that did need consent, we would add a proper opt-in first and update this page.
How to clear it
You’re in control of everything above. Three options, from gentlest to most thorough:
- Start a new crawl. The “Start a new crawl” button in the app wipes your current plan, punches and scores (
subcrawl.plan.v3andsubcrawl.run.v3) and leaves any live crawl you were in. - Sign out. If you signed in, signing out removes the sign-in token from your browser. Your account itself still exists on our side until you ask us to delete it: see the Privacy Policy.
- Clear site data in your browser. This removes everything at once, including anything Cloudflare set. On iPhone: Settings → Safari → Advanced → Website Data, find
sub-crawl.pages.devand swipe to delete. On Android Chrome: tap the padlock or site-info icon next to the address, then “Cookies and site data” or “Site settings” → “Delete data”. On desktop browsers, use the site-information icon in the address bar or the “Clear browsing data” screen. Note that this also throws away an unsaved crawl.
Blocking storage entirely in your browser will stop the app remembering your crawl between visits, and live mode won’t be able to keep you signed in, but the planner will still open.
Changes to this page
If we add, remove or rename anything the app stores in your browser, or start using a new third-party service, we’ll update this page and the “last updated” date at the top. If we make a significant change we’ll say so on the home page. This version was last updated on 10 September 2026.
Contact
Sub Crawl is built and run by one person based in Glasgow, Scotland. If anything here is unclear, or you think the app is storing something not listed, email playsubcrawls@gmail.com. For how we handle personal data more broadly, including your rights and how to delete an account, see the Privacy Policy.