Legal — pilot draft

Cookie Notice (draft)

An unapproved pilot draft recording only what the completed technical census established. TorosRicos OÜ is the proposed operator of Bobby Brand, subject to verification.

Draft — legal review and Platform Owner approval required

What the census established

Authentication is implemented and in use. The application authors no cookies of its own, though a signed-in session is kept in your browser's local storage, which is strictly necessary for signing in. No analytics, advertising, session-replay, CAPTCHA, external-font or embedded-media provider is present. Cookies that the hosting platform may set outside application code have not yet been verified against production responses, and are stated below as unverified rather than as absent.

1. Storage controlled directly by Bobby Brand

The application authors no cookies of its own. No sessionStorage and no IndexedDB use was found.

2. Authentication-related storage

Signing in stores an authentication session in your browser's local storage, provided by the Lovable Cloud authentication service. It is strictly necessary to keep you signed in and is not used for tracking or profiling. Signing out removes it. Inside the Lovable editor preview only, a cross-frame storage shim proxies the same session; it is not a separate tracking mechanism. No retention period is stated here, because none has been established.

3. Infrastructure and security cookies

The published site is served by the hosting platform, which may set operational cookies outside the application's control. This has not been verified against production response headers, so no claim is made either way. It remains an open item and must be verified before this notice can become effective.

4. Optional analytics or marketing storage

None. The census found no analytics, advertising, session-replay or embedded-media provider, and no third-party font request. Because no non-essential storage exists today, no consent banner is presented. This is provisional and will be re-evaluated whenever a provider, tool or embed is added.

5. Functionally necessary browser storage

Beyond the authentication session described in section 2, no functionally necessary browser storage was identified.

6. Consent management

A consent mechanism will be introduced together with the first non-essential storage, not before. Consent state will be recorded and revocable.

7. Third parties

Payment processing, website analysis and AI providers may set their own storage on their own surfaces. None is connected today. Each will be listed here once implemented and verified.

8. Status

This page is a draft. It is not effective, carries no effective date, has not been reviewed by counsel and has not been approved. Where evidence is incomplete it is marked as unverified above rather than resolved by assumption.