Cookie Policy
Every cookie and storage key we set, and how to turn off the optional ones.
Last updated: 22 July 2026
The short version
We use a small number of cookies to keep you signed in and to keep your account secure. We also measure page views ourselves so we can improve the product — you can decline that, and declining changes nothing about how the app works. We set no advertising cookies and load no third-party tracking scripts.
1. Cookies and browser storage
A cookie is a small file a site stores in your browser. Alongside cookies we use local storage and session storage, which work similarly but are not sent with every request. This policy covers all three, because from your point of view the privacy question is the same.
2. Strictly necessary
These make sign-in and security work. They cannot be turned off, because without them you could not log in. We do not ask for consent for these, as permitted under the ePrivacy rules.
| Name | Purpose | Expires |
|---|---|---|
sb-<project>-auth-token | Your Supabase authentication session — keeps you signed in. | 1 hour, refreshed while active |
tv_device | Marks this browser as a device you have verified by one-time code, so you are not asked for a code every login. HTTP-only, so scripts cannot read it. | 20 days |
theme | Remembers whether you chose light or dark mode. | Until you clear it |
3. Analytics — optional
We measure traffic ourselves rather than sending it to Google Analytics or a similar service. The data stays in our own database and is never sold, shared or used for advertising.
| Name | Purpose | Expires |
|---|---|---|
tv_visitor | A random identifier that lets us tell a returning visitor from a new one. It contains no personal information and is not linked to your account. | Until you clear it |
tv_session | Groups the pages you view in one visit into a single session. | When you close the tab |
tv_consent | Remembers your choice on this banner, so we stop asking. | 6 months |
If you decline, we set none of the above except tv_consent, and no page views are recorded.
4. Marketing and advertising cookies
We do not use any. There are no advertising pixels, no retargeting tags, no conversion trackers and no social media tracking scripts anywhere on this website. We do not participate in any advertising network, and we do not sell or share personal information for advertising.
5. Third-party cookies
We set none. The only cookies on this domain are the first-party ones listed above.
Two things are worth flagging so the picture is complete. Fonts are served from Google Fonts, self-hosted at build time by Next.js — your browser does not contact Google when you load a page. And if you click a link to LinkedIn, Facebook or WhatsApp, that site sets its own cookies once you arrive, under its own policy, not ours.
6. Managing your choice
You can change your analytics choice at any time, and it takes effect immediately:
You can also block or delete cookies in your browser settings — see the help pages for Chrome, Safari or Firefox. Blocking the strictly necessary cookies will stop you being able to sign in.
We honour the Global Privacy Control signal: if your browser sends it, analytics stays off and we do not show the banner.
7. Changes and contact
If we ever add a cookie, this page is updated before it ships and — where the law requires it — we ask for your consent again. Questions: hello@tourvilo.com. See also our Privacy Policy.