Cookie Policy

Sign-in. The Supabase client keeps your session in cookies whose names start with sb-, including sb-…-auth-token. While a login is in progress it may also set a short-lived sb-…-code-verifier cookie. A large session is split into chunks such as .0 and .1. These cookies are what keep you signed in.

Profile opens. After a public profile records an open, we set an httpOnly cookie named hs_lo_ plus that profile’s id. It is SameSite=Lax, Secure, path=/, and it expires after 30 minutes. It stops the same browser from counting another open of that profile during that window. We do not set it for the profile’s owner, for link-preview bots, or when the count fails to save.

localStorage, on this browser only:

hs_revealed_shots: plus a profile id — pictures you chose to reveal on that profile. hs_activity_seen_at — when you last opened Activity. hs.search.recent.v1 — recent searches and profiles. headshot-social-mock-portfolio — a local mock portfolio used only when the app has no database configured. Live accounts are not stored there.

sessionStorage lasts for the tab. hs_saved is a one-time flag so a saved banner can show after you edit your profile, and it is removed as soon as it is read. role-draft: plus a casting-call id is an unsaved role-profile draft, removed when you save or discard.