Cookies and Local Storage

Last updated 6 September 2026 · Privacy Policy · Terms of Use

The short version

Sub Crawl sets no cookies of its own. It keeps a small amount of data in your browser’s local storage so the app works: your crawl plan, your punches and scores, which live crawl you’re in, and (only if you sign in) your sign-in token. All of it exists to do the thing you asked the app to do. Nothing is used for advertising or to track you across other websites, which is why there’s no cookie banner.

This page lists every item, what it’s for, how long it lasts and how to clear it. Sub Crawl is run by Matthew Mooney, an individual in Glasgow; questions to mooneymatthew02@gmail.com.

What is stored in your browser

“Local storage” and “session storage” are places a website can save data in your browser. Unlike cookies they are not sent to any server automatically; the app reads them itself when it needs to. Everything below is kept on your device only, except where the row says otherwise.

Name	Type	Purpose	Lifetime	Strictly necessary?
`subcrawl.plan.v3`	localStorage	Your current crawl plan: the stations, pubs, drinks and rules you picked. Lets the app work offline and remember your crawl when you come back. Stays on your device unless you choose to save or share it.	Until you press “Start a new crawl” or clear your browser data	Yes
`subcrawl.run.v3`	localStorage	Your progress on that crawl: which stops you’ve punched and the scores you’ve entered. Device only.	Until you press “Start a new crawl” or clear your browser data	Yes
`subcrawl.live.session.v1`	localStorage	Which live crawl (room) you’re currently in, so the app can rejoin it if you close the tab or lose signal underground.	Until you leave the live crawl, start a new crawl or clear your browser data	Yes
`subcrawl.live.queue.v1`	localStorage	Scores you’ve entered in a live crawl that haven’t reached the server yet (for example, because you had no signal). They’re uploaded when you’re back online and then removed.	Until each score uploads successfully; otherwise until you clear your browser data	Yes
`sb-<ref>-auth-token`	localStorage	Your sign-in token, set by our database and sign-in provider (Supabase) only after you sign in. It keeps you signed in and is sent to Supabase to prove it’s you. “<ref>” is a fixed code identifying our Supabase project, not you.	Until you sign out or clear your browser data; the token itself is refreshed automatically while you stay signed in	Yes (only exists if you chose to sign in)
`subcrawl.pendingName`	sessionStorage	Holds the display name you typed for a few seconds while you’re sent to Google to sign in and back again, so we can attach it to your account when you return.	Removed as soon as you return from Google; gone in any case when the tab closes	Yes (only during Google sign-in)
`__cf_bm` / `cf_clearance` (or similar)	HTTP cookie (third party: Cloudflare)	The site is hosted on Cloudflare Pages. On some requests Cloudflare may set a short-lived cookie to tell real visitors apart from bots and to protect the site from abuse. Sub Crawl doesn’t read it and it isn’t used to identify you to us.	Typically 30 minutes for `__cf_bm`; up to a year for `cf_clearance` if it is ever set	Yes (security)

That’s the whole list. There are no analytics cookies, advertising cookies, social-media cookies or fingerprinting.

Third-party requests

When you use Sub Crawl your browser may also talk to a few other services. None of them set cookies for Sub Crawl or track you across sites, but you should know they exist:

Cloudflare (sub-crawl.pages.dev) hosts the website. Every page you load is served by Cloudflare, who keep standard short-term technical logs (such as IP addresses) to run and protect the service. See the bot-protection cookie above.
Cloudflare Web Analytics, if enabled, gives us aggregate page-view counts. It is cookieless: it sets no cookies, stores nothing in your browser and uses no fingerprinting, so it cannot recognise you between visits.
Supabase (database and sign-in, hosted in London) is contacted only when live mode is switched on and you sign in, host or join a live crawl. The supabase-js library that does this is loaded from cdn.jsdelivr.net, again only when live mode is configured. Loading a file from a CDN reveals your IP address to that CDN, as with any download.
Google is involved only if you choose “Sign in with Google”. The sign-in itself happens on Google’s own pages under Google’s cookie and privacy rules; Sub Crawl doesn’t embed any Google script.
Chart.js from cdnjs.cloudflare.com is loaded on the admin dashboard page only, which is visible to the site owner and nobody else.
Buy Me a Coffee is an ordinary outbound link. Nothing from Buy Me a Coffee is embedded in Sub Crawl; if you tap the tip button you leave for their website, which has its own cookie policy. See our Tips and refunds page.

Fonts are served from our own site, not from a font provider, so no font-hosting service sees your visit.

UK law (the Privacy and Electronic Communications Regulations, alongside UK GDPR) says a website needs your consent before storing or reading information on your device unless that storage is strictly necessary to provide a service you have asked for. Cookieless analytics that store nothing on your device and use no persistent identifier fall outside the consent rules altogether.

Everything Sub Crawl stores is in the first category: the plan and progress you built, the live room you joined, the scores waiting to upload, and the token that keeps you signed in after you chose to sign in. Cloudflare’s bot-protection cookie exists purely to keep the site up and secure. Our analytics, if switched on, are cookieless. So there is nothing to ask consent for, and we’ve chosen not to show a banner that would only get in your way.

If that ever changes, for example if we added a tool that did need consent, we would add a proper opt-in first and update this page.

How to clear it

You’re in control of everything above. Three options, from gentlest to most thorough:

Start a new crawl. The “Start a new crawl” button in the app wipes your current plan, punches and scores (subcrawl.plan.v3 and subcrawl.run.v3) and leaves any live crawl you were in.
Sign out. If you signed in, signing out removes the sign-in token from your browser. Your account itself still exists on our side until you ask us to delete it: see the Privacy Policy.
Clear site data in your browser. This removes everything at once, including anything Cloudflare set. On iPhone: Settings → Safari → Advanced → Website Data, find sub-crawl.pages.dev and swipe to delete. On Android Chrome: tap the padlock or site-info icon next to the address, then “Cookies and site data” or “Site settings” → “Delete data”. On desktop browsers, use the site-information icon in the address bar or the “Clear browsing data” screen. Note that this also throws away an unsaved crawl.

Blocking storage entirely in your browser will stop the app remembering your crawl between visits, and live mode won’t be able to keep you signed in, but the planner will still open.

Changes to this page

If we add, remove or rename anything the app stores in your browser, or start using a new third-party service, we’ll update this page and the “last updated” date at the top. Significant changes will be flagged in the app. This version was last updated on 6 September 2026.

Contact

Sub Crawl is built and run by Matthew Mooney, an individual based in Glasgow, Scotland. If anything here is unclear, or you think the app is storing something not listed, email mooneymatthew02@gmail.com. For how we handle personal data more broadly, including your rights and how to delete an account, see the Privacy Policy.