Cookie Policy

1. What is a cookie?

A cookie is a small text file placed on your device when you visit a website. Some cookies are essential for a site to work; others track your behaviour for advertising. This policy also covers similar technologies that store information on your device or read it, namely your browser's local storage and session storage and the service worker of our app. We use them to keep you signed in and to remember your settings. This page lists every one of them.

2. What we use

We use nothing for advertising and nothing that follows you across other websites. Each entry shows what it is, who sets it, what it is for and how long it is kept.

Cookies

• `locale_choice`: cookie, set by DOIN'. Remembers the language you picked with the language switcher. Set only when you click the switcher. Kept 1 year.
• `theme_preference`: cookie, set by DOIN'. Remembers whether you chose the light or the dark look. Set only when you pick one. Kept 1 year.
• `locale_preference`: cookie, set by DOIN'. Remembers the language of the last challenge you opened, so other pages open in it. Set automatically. Deleted when you close your browser.
• `cf_clearance`: cookie, set by Cloudflare. Records that your browser has passed a security check. Set only if Cloudflare asks your browser to complete such a check. Kept up to 1 year.

Local storage (stays until you remove it or clear your browser's site data, unless a shorter time is stated)

• `sb-…-auth-token`: set by DOIN' through Supabase. Keeps you signed in. Kept until you sign out.
• `doin.last_auth_method`: set by DOIN'. Remembers how you signed in last (email, Google or Apple), so the sign-in screen opens on the right tab.
• `doin-accept-intent-…` (ends with the challenge code): set by DOIN'. Holds the challenge invitation you are in the middle of accepting while you sign in or create an account. Valid for 10 minutes; removed once you have joined or cancelled.
• `doin-pending-legal-consent`: set by DOIN'. Holds the age and terms boxes you ticked before signing in, so we can record them after. Valid for 10 minutes; removed once saved.
• `doin_ob_…` (ends with your account id): set by DOIN'. Remembers that you skipped or finished the introduction when creating your first challenge.
• `doin_ugc_ok`: set by DOIN'. Remembers that you ticked the photo-sharing box when creating a challenge, so you do not have to tick it each time.
• `notif_asked_at` and `notif_dismissed`: set by DOIN'. Remember when we offered you notifications and that you closed the offer (we do not ask again for 7 days after you press Enable, and never after you close it).

Session storage (deleted when you close the tab)

• `doin_click_…` (ends with the challenge id): set by DOIN'. A marker that this tab already opened this challenge link, so each challenge link is counted once per visit in the organiser's totals. It contains no identifier and is not used to follow you.
• `bbq_registration_draft` and `bbq_pending_result`: set by DOIN' on our BBQ game page. Hold the name you typed and your game result while you sign in.

Service worker

• `/sw.js`: our app's service worker, which lets you install the app on your home screen. It also loads the notification-handling script of OneSignal, our push provider, from cdn.onesignal.com.

We do not use advertising cookies, retargeting pixels, or any cookies that track you across other websites. We do not sell data to advertisers.

3. Why we do not ask for consent

The rules (ePrivacy Directive, Art. 5(3)) require your consent for storing or reading information on your device, except where it is needed to send the communication or to provide a service you have asked for. We apply that as follows:

• Needed for the service you asked for: the sign-in token, the invitation and consent entries that bridge sign-in, cf_clearance (security of the connection), the introduction, photo-sharing, notification and BBQ entries. Without them signing in, joining a challenge or playing would not work or would repeat itself.
• Settings you chose yourself: locale_choice, theme_preference, doin.last_auth_method. They appear only after you act, and they only make the app do what you asked.
• Set automatically for convenience: locale_preference. It is first-party, contains only a language code, is used only to show pages in the language you last saw, and is deleted when you close your browser.
• Counting link opens: the doin_click_… marker stores nothing about you, lasts only while the tab is open, and exists so that an organiser's totals are not inflated by reloads.
• Notifications: the only thing that depends on your consent. Push notifications are opt-in: we never send them without your explicit consent, and every notification we send is logged in our database with a consent-verified flag. You can change your push notification preferences in the settings.

We do not use any cookie or storage that needs consent before you have given it.

4. Managing your preferences

• Clear what we have stored: in your browser, clear cookies and site data for startdoin.com (Settings, Privacy, Clear browsing data). You will be signed out and your language and look choices will reset.
• Block cookies or storage: you can configure your browser to block them. Blocking local storage will sign you out. Blocking cookies only resets language and look choices.
• Notifications: if you have allowed notifications for startdoin.com in your browser, you can turn them off in your browser's site settings.
• Cloudflare: cf_clearance is set on our behalf by Cloudflare. See Cloudflare's privacy policy.

5. Changes to this policy

We will update this page when something changes. If the change only corrects or clarifies what we already do, the "Last updated" date changes and nothing else. If we start using a new technology or use an existing one for a new purpose, we will announce it in the app and on startdoin.com, and where consent is required we will ask for it before the technology is switched on. Updating this text alone is never enough.

6. Contact

Questions about our use of cookies: hey@startdoin.com. How we handle your personal data is described in our Privacy Policy.