Cookies and Local Storage
What we store in your browser and on your device, and why.
1.The short version
halallo.com and HalallO for Business do not use advertising cookies, analytics cookies or third-party trackers. They store only what is needed to keep you signed in, finish a password reset, and protect forms from bots. Because these are strictly necessary, they don’t need your consent, and there is no cookie banner.
2.On halallo.com
| Name | Type | What it does | How long |
|---|---|---|---|
| halallo-web-auth | Local storage (first party) | Only on the password-reset page: holds the temporary session that lets you choose a new password. We sign you out of the website as soon as the password is saved. | Until the password is saved or you close the reset |
| halallo-web-auth-code-verifier | Local storage (first party) | A one-time secret used to finish a password reset link (PKCE). | Removed when the link is used |
| Cloudflare Turnstile | Third-party challenge (challenges.cloudflare.com) | When the security check is switched on, it checks that a person, not a bot, sent the waitlist form. | For the check; see Cloudflare’s privacy policy |
Joining the waitlist doesn’t set a cookie. Fonts are served from our own domain.
3.On business.halallo.com
| Name | Type | What it does | How long |
|---|---|---|---|
| halallo-business-auth | Local storage (first party) | Keeps your sign-in session (access and refresh tokens from our authentication provider, Supabase) so you stay signed in. | Until you sign out, the session expires, or you sign out on all devices |
| halallo-business-auth-code-verifier | Local storage (first party) | A one-time secret used to finish a secure sign-in or password reset link (PKCE). | Removed when the link is used |
| Cloudflare Turnstile | Third-party challenge (challenges.cloudflare.com) | When the security check is switched on, it checks that a person, not a bot, is signing in, signing up or resetting a password. Cloudflare processes technical signals from your browser for this purpose only. | For the check; see Cloudflare’s privacy policy |
Fonts are served from our own domain, so loading a page doesn’t contact Google or any font service. Our hosting provider (Vercel) doesn’t set cookies on the public site (password-protected preview builds are the only exception). If that changes, we will list them here.
4.In the HalallO app
The app stores your session securely on your device and keeps preferences such as appearance, distance unit and whether you have seen the introduction. These stay on your phone. The app has no advertising or analytics SDKs today.
5.If this changes
We plan privacy-friendly product analytics (PostHog, EU hosting). Before turning it on we will update this page, offer an opt-out, and ask for consent first where the law requires it (for example in the EU and UK). [Decide the consent mechanism before analytics launch.]
6.Your choices
You can clear site data in your browser settings at any time; you will be signed out. Blocking local storage stops sign-in from working. More about your data in the Business Privacy Notice and the Privacy Policy.