What the application uses
Supabase authentication uses an sb-[project]-auth-token entry in browser storage, and may use related session or callback entries, to maintain the requested sign-in. Authentication tokens are sensitive and should not be copied into support messages. The platform's separate ChatGPT sign-in may use its own cookies.
earnsela-workspace:[account ID] stores work records and local feature preferences, including form drafts. earnsela-cloud:[account ID] stores this device’s cloud-recovery choice and last saved revision; a before-restore workspace copy and separately keyed original/recovered files allow undo of the latest restore. IndexedDB also retains a shared merge base and the exact pending upload with its files until success, reconciliation or explicit deletion. earnsela-files:[account ID] is an IndexedDB database holding uploaded workspace files. proofmypay-v1 and proofmypay-files may contain earlier prototype records retained only for explicit recovery. These entries remain until removed and do not automatically expire with sign-out. earnsela-shift-ledger:[account ID] stores the Shift sync choice, random device identifier, pending event uploads, latest server receipts and sync cursor. A before-review copy is retained locally when resolving a conflict. Pausing sync does not delete cloud history or the pending device copy. earnsela-language stores a language choice before sign-in; earnsela-language:[account ID] stores the selected interface language for that account on this browser. The preference may also be saved to account profile metadata to apply on another device. Local interface translations do not send work records or documents to a translation service.
The proposed subscription uses server-side subscription and billing records. It must not use advertising storage to determine paid access. A future hosted checkout may introduce payment-provider storage; that provider's current purposes and policies must be reviewed before activation.
Tracking choices
There is no product analytics or advertising tracker in the application code, so the prototype does not offer an 'accept all' button that would enable one. Remote Google Fonts have been removed from the workspace to avoid unnecessary font-provider requests. Infrastructure security logs and access controls are distinct from product behavioural analytics and must be covered in the final notice.
The purpose of each technology determines whether a PECR exception applies. We will not assume that all local storage is exempt just because it is not a cookie. Where prior consent is required, optional storage and tracking must stay off until a valid choice is made. Where an applicable exception requires information and an objection mechanism, those requirements must also be met. The final assessment must cover the actual deployed service.
Your controls
Your account provides device preferences for future location stamps and shift reminders. Location remains optional; switching it off does not erase previous records. Browser settings separately control site location and notification permissions. Disabling future reminders does not remove events already imported into a calendar.
You can remove browser storage in browser settings, but this can permanently remove local records and files. Export first. Cloud copies, payment records and account information are not erased by clearing this device. We will reassess the inventory before adding analytics, marketing or a live payment service.
Review and changes
This is a code-level inventory, not a completed deployment audit. A commercial release must check the actual hosting access gate, authentication routes and any checkout supplier, and implement any necessary consent or applicable exception/objection controls before activating new storage. Agreeing to service terms or buying a subscription is not device-tracking consent.