Cookies policy.

Cookies set by the Service

None, under normal use. The Service does not set any first-party cookies for analytics, advertising, personalisation, or any other non-essential purpose.

Local storage (not cookies)

The Service uses the browser's local storage API — a separate mechanism from cookies, not transmitted with each HTTP request — to keep the following on your device:

• Session token (JWT). When you sign in, the authentication provider (Supabase Auth) stores a JSON Web Token in local storage so you remain signed in across visits and browser tabs. The token is scoped to muses.exchange and never transmitted to third parties.
• User-interface preferences. Your selected theme, ticker-tape toggle, reduce-motion preference, default order type, chart timeframe, and similar UI state. These never leave your browser.
• Cached portfolio snapshot. A local copy of your paper-trading portfolio and recent price data, kept to speed up page loads. The authoritative copy lives in our database; the local copy is a mirror.

You can clear the above at any time by clearing site data in your browser's settings or by signing out of the Service. Signing out invalidates the session token server-side and removes it from local storage.

Cookies set by our processors

• Plausible Analytics. Does not set any cookies and does not generate a persistent visitor identifier. See the Plausible data policy for technical detail.
• Netlify (hosting provider). Netlify may set short-lived security cookies at the edge for DDoS and bot protection. These are classified as strictly necessary under Article 5(3) of the ePrivacy Directive and its national transpositions, and therefore do not require consent. See the Netlify privacy notice.
• Supabase (authentication and database provider). Supabase does not set any cookies on your browser in the course of providing our authentication flow; the session token is held in local storage, as described above.
• Sentry (error reporting). Sentry does not set any cookies on your browser. Error reports are transmitted directly by the in-page SDK using fetch() requests.

Why no cookie banner?

The consent obligation in Article 5(3) of the ePrivacy Directive applies to the storing of, or gaining access to, information on a user's device where that storage or access is not strictly necessary for the service expressly requested by the user. The Service does not use any cookies or similar technologies in that category: its analytics are cookieless, its authentication session is strictly necessary, and there are no advertising, profiling, or cross-site tracking technologies in play. Accordingly, there is nothing on which to request consent. If that position ever changes, a banner will be displayed before any non-essential storage or access takes place.

Third-party embeds

The Service does not currently embed third-party video players, maps, comment systems, or social-media widgets that would set their own cookies in your browser. If any such embed is added in the future, this page will be updated and — where consent is required — a banner will be presented before the embed loads.

Browser controls

Most browsers let you refuse cookies, clear existing cookies and local storage, or receive a prompt before storing them. Because Muses Exchange does not depend on third-party cookies, disabling them will not affect your experience. Clearing local storage, however, will sign you out and reset local UI preferences.

See also: privacy policy, terms of use. Questions: privacy@muses.exchange.