Cookie Policy
Last updated: 21 May 2026
This page explains the cookies and similar technologies (local storage, session storage, IndexedDB) used by the Play on the Pitch app, why we use them, and how you can control them. We use no advertising cookies, no cross-site trackers, and no third-party analytics scripts.
What are cookies and similar technologies?
"Cookies" are small text files stored by your browser. This app mostly relies on browser local storage, session storage, and IndexedDB — they serve the same purpose as cookies and, under UK GDPR / ePrivacy rules, are treated the same way. We refer to all of them as "cookies" below for simplicity.
Your choices
When you first visit the app you see a banner with two options: Accept and Necessary only. Choosing "Necessary only" disables analytics tracking. Strictly necessary cookies (those required to sign you in and run the app) are always set.
You can change your choice at any time:
- — clears your saved preference and reopens the banner.
- Clear the site's storage from your browser settings (Application / Storage panel in DevTools, or Settings → Privacy → Clear site data).
1. Strictly necessary
Required for the app to function. These do not require consent under GDPR.
- Authentication session — keeps you signed in across page reloads. Set by our authentication provider (Supabase) in local storage.
- Consent record (
potp.consent.v1) — remembers your cookie choice so we don't ask again on every page. - Offline event cache — stores the schedule, map, kit list, and other event content on your device so the app works without a signal at the stadium. Stored in local storage and IndexedDB.
- Sidebar UI state (
sidebar_state) — a small cookie that remembers whether the admin sidebar is open or closed.
2. Functional
Improve your experience but contain no personal data and never leave your device.
- Map 3D toggle — remembers whether you had the stadium map in 3D or 2D mode (session storage, per-tab).
- Map viewport — remembers where you had panned/zoomed the stadium map (session storage, per-tab).
3. Analytics (consent required)
Used only if you click "Accept" on the cookie banner. Helps us understand which pages of the app are used most.
- Session id (
potp.session.v1) — a random identifier generated in session storage so we can count unique visits per browser tab. It is not linked to any external profile. - Page view records — we record, in our own database, the page path you visited, the timestamp, the session id above, your user id (if signed in), the referring URL, and a truncated user-agent string. These records are visible only to administrators of the event.
We do not record clicks, scroll, keystrokes, form input, precise location, or IP-based geolocation. We do not run third-party analytics scripts (no Google Analytics, no PostHog, no Facebook pixel, etc.).
Detailed list
| Name | Type | Duration | Category | Purpose |
|---|---|---|---|---|
| sb-*-auth-token | localStorage | Until sign-out | Strictly necessary | Keeps you signed in |
| potp.consent.v1 | localStorage | Until cleared | Strictly necessary | Remembers cookie choice |
| potp.event.cache | localStorage + IndexedDB | Until cleared | Strictly necessary | Offline event content |
| sidebar_state | Cookie (first-party) | 7 days | Strictly necessary | Sidebar open/closed |
| anfield.map.3d | sessionStorage | Tab lifetime | Functional | Map 3D/2D preference |
| anfield.map.viewport | sessionStorage | Tab lifetime | Functional | Map pan/zoom position |
| potp.session.v1 | sessionStorage | Tab lifetime | Analytics (consent) | Counts unique tab visits |
| page_views (server) | Database record | Event lifetime | Analytics (consent) | First-party page-view analytics |
Third parties
We use the following processors. None of them set tracking cookies on this domain.
- Supabase — authentication and database hosting. Privacy policy.
- MapTiler — stadium map tiles. Tiles are fetched through a local service-worker proxy, so MapTiler does not set cookies on this domain. Privacy policy.
- Resend — transactional email delivery (magic links, password reset). Not a cookie; processes your email address only. Privacy policy.
Legal basis
- Strictly necessary & functional — Article 6(1)(f) UK GDPR (legitimate interest in delivering the app).
- Analytics — Article 6(1)(a) UK GDPR (your consent), given via the cookie banner.
Your rights
You can withdraw consent at any time using the reset button above. You also have rights of access, rectification, erasure, restriction, portability, and objection. See our Privacy Notice for the full description.
Contact
Questions about cookies or data? Email privacyofficer@orioninc.com.