Cookies
Updated Sep 13, 2026
UnboxingTN uses few cookies, and no advertising cookie at all. The table below names all of them: three the site always sets, one that exists only while you are signed in, and a small group that exists only for the length of a sign-in. The mobile app uses no cookies whatsoever — it keeps the same settings in the device's own storage, which comes to the same thing and never leaves the phone.
Strictly necessary cookies
These do not ask for your agreement: without them the site cannot do what you are asking it to do.
| Name | What it does | Life |
|---|---|---|
locale | the language you read, so the page arrives already translated | 1 year |
theme | light or dark, so there is no white flash while loading | 1 year |
consent | your answer to the banner, so it is not asked again | 1 year |
sb-…-auth-token | your session, if you are signed in; set by Supabase Auth | until you sign out |
sb-…-code-verifier | the one-time secrets that secure signing in with Google (PKCE): one per attempt, plus the short list that keeps track of them — three cookies for an ordinary sign-in | for the length of the sign-in |
That last line is a group, not a single cookie. Supabase sets one per sign-in attempt — its name carries a random number — plus two more that keep track of them, so three cookies for an ordinary sign-in. That secret is what proves the code Google sent back was meant for your browser and no other; it never travels to Google, and it says nothing about you. They are gone when you come back from Google; an attempt you abandon halfway — a tab closed — can leave its own behind, and Supabase keeps only the last five and erases the ones before.
The session cookie is set once you are signed in, and Sign out erases it.
Analytics
If you accept analytics, PostHog sets cookies of its own to tell one visit from another. They tie your page views to a random identifier, never to your account or your e-mail.
| Name | What it does | Life |
|---|---|---|
ph_…_posthog | join up the page views of one visit | 1 year |
Until you accept, PostHog's script is not loaded at all: there is nothing to block, and nothing has left.
A crash report is not a cookie
Sentry, which tells us when a page breaks, sets no cookie, keeps no IP address and records nothing of your screen. That is why it is treated as strictly necessary and works without your agreement: it cannot recognise you.
What is not here
No advertising pixel, no social button that follows you, no typeface loaded from somebody else's server, no data shared with an ad network. Nothing at all is loaded from another site: an UnboxingTN page asks nothing of anybody but UnboxingTN and its database.
Sign in with Google is no exception: it is our own button, and it takes you _to_ Google — you leave the site, you see Google's address in your browser, and you come back. Google is never embedded in our pages and does not see you until you press it.
Changing your mind
Your choice can be changed at any time, at the bottom of this page, in the site footer and on the Account screen. Refusing after having accepted stops the measurement immediately. You can also delete these cookies in your browser's settings; the site will keep working, it will simply have forgotten your language, your theme and your answer.
Analytics
You can change your mind at any time; refusing takes effect immediately.
No answer yet