1. Necessary and requested functionality
Persistent sign-in uses browser session storage in local storage, not an application HttpOnly authentication cookie. Choosing a language saves a preference; designing a concept retains an unsaved local draft. Temporary sign-in navigation uses session storage. Cloud projects are separate from device storage.
The inventory below identifies name, provider, purpose, category, observed/configured lifetime, scope and consent assessment. Necessary/requested-function exemptions depend on the confirmed jurisdiction and legal assessment; functional labels alone do not settle the law.
2. Published hosting technologies
A clean published visit observed __dpl and __cf_bm cookies, plus injected hosting measurement and diagnostic scripts with same-origin collection endpoints. Flock code creates a session-id cookie and sends full page/referrer URLs in normal browsing; automated browsers skip that path. Host-events uses in-memory event identifiers and page/error measurements. A clean automated published visit sent a diagnostic batch to /__l5e/trackevents before any consent choice and received HTTP 202; acceptance does not establish retention or downstream use. Session replay is supported by the script but was not enabled in inspected published attributes. No Google Analytics or Meta Pixel was configured in the app. Hosting measurement is not treated as disabled merely because an application consent banner is absent.
Official documentation describes a project-wide Visitor analytics disable setting. Its coverage of the deployed Flock and diagnostic scripts has not been verified, and no visitor-level consent interface is established. The documentation describes cookie-free analytics, while the inspected deployed Flock code contains a session cookie; that discrepancy requires clarification. The provider must confirm identifiers, session replay activation, payloads, recipients, retention and controls. App code cannot read/remove HttpOnly cookies or guarantee withdrawal from independently injected host scripts. Prior consent for any non-exempt measurement remains a publication blocker until it is disabled or properly controlled.
3. External resources and conditional technologies
Fonts are bundled on-site in the updated preview, removing unconditional Google font connections there. Earlier published checks observed Google font requests; the latest clean published visit observed none. This phase did not deploy the app. Font delivery was not evidence of Google analytics cookies. Social sign-in contacts the chosen provider and broker when requested; provider cookies outside our domain require separate provider disclosures.
An unused reusable sidebar contains a seven-day sidebar_state cookie writer; inspected layouts do not mount it and clean runtime checks did not observe that cookie. It is a conditional code capability, not an active visitor cookie. No fictional Google/Meta advertising-cookie table is included.
4. Settings and withdrawal limits
Privacy & storage settings can be reopened through the legal links. They accurately explain functional storage and the unresolved host measurement boundary; they do not present fake optional categories, record a misleading acceptance or claim to stop hosting telemetry.
Browser controls can remove first-party local/session storage, but removing authentication signs you out and clearing a local draft may lose unsaved work. We do not bulk-delete storage or Cloud projects through these settings. Where optional technologies are introduced, they must remain blocked until consent, provide equally accessible acceptance/rejection/configuration, record the approved consent version and support withdrawal and removal of controllable cookies.
Reject/withdraw behavior for host measurement cannot yet be certified. A host-controlled telemetry resolution is required before commercial publication. No new optional tracking is enabled by this phase.
Device storage
| Name / technology | Provider / scope | Purpose & category | Lifetime / control | Consent assessment |
|---|---|---|---|---|
| sb-<project>-auth-token | Lovable Cloud authentication; first-party browser storage | Necessary for requested persistent sign-in; access and refresh tokens, account identity and session metadata. Preview may broker this storage to the Lovable editor. | No fixed browser expiry is set by app code; access tokens expire and refresh. Sign-out removes the session; expiry/revocation is provider-controlled. | Required for requested sign-in; not an analytics choice. Legal classification to be approved. |
| thex.locale | The X Store; first-party local storage | Functional language preference (English or Bulgarian). Written after an explicit language/URL choice. | No automatic expiry; until overwritten or cleared in browser settings. | Requested preference; exemption assessment requires legal review. |
| thex.designer.draft | The X Store; first-party local storage | Functional unsaved store configuration, project and owner IDs. Shared-device users should protect their browser profile. | No automatic expiry. Draft persists between visits; account checks restrict restoration. Saving also creates Cloud records. | Requested drafting continuity; not third-party tracking. Legal assessment pending. |
| thex.auth.destination | The X Store; first-party session storage | Requested return destination across sign-in, including a same-origin path and possible project reference. | Removed after sign-in handling or when the browser session ends. | Necessary navigation during requested sign-in; legal assessment pending. |
| __dpl | Lovable hosting; first-party-domain cookie | Observed deployment cookie. Exact host purpose and classification need provider confirmation; do not assume tracking or exemption. | Observed expiry approximately one day; provider-controlled, may change. | Unconfirmed provider classification; publication review blocker. |
| __cf_bm | Cloudflare / hosting; first-party-domain HttpOnly cookie | Bot-management cookie observed on the published domain. Not written by application code. | Observed expiry approximately 30 minutes; provider-controlled. | Security-related; applicable exemption and provider disclosures require legal review. |
| session-id | Lovable hosting measurement; first-party cookie | Injected Flock script uses a random session identifier and sends page hits, full page/referrer URLs, browser agent and timezone-derived country. Code verified; automated browsers skip its page-hit path, so the cookie was not observed in that check. | Code configures 30-minute expiry refreshed on events; Secure, path /. No explicit SameSite. Optional local/session storage modes exist but are not selected by published attributes. | Optional measurement requires disablement or appropriate prior consent. A project-wide Visitor analytics disable setting is documented, but its coverage of both injected scripts and visitor-level consent/withdrawal is not runtime-verified; publication remains blocked. |
| tsr-scroll-restoration-v1_3 | TanStack Router; first-party session storage | Functional scroll-position restoration, enabled in the current application router. | Browser-session storage; no persistent app retention period. | Requested navigation continuity; legal exemption assessment pending. |
Legal & privacy contact
Nikolov.n.ivaylo@gmail.com- Operating legal entity
- Founder confirmation pending
- Company registration number
- Founder confirmation pending
- VAT number, if applicable
- Founder confirmation pending
- Registered office
- Founder confirmation pending
- Applicable jurisdiction
- Founder confirmation pending
- Data Protection Officer, if required and appointed
- Founder confirmation pending
Legal review required
Operator identity, lawful bases, retention, transfers, eligibility, liability, jurisdiction and the Bulgarian legal wording require qualified legal approval. This draft is not a compliance certification.