01

Session and room cookies.

Cookies set by the application
Name or patternPurposeConfigured lifetime
vibestarz_hostAuthenticates a password-based host session.12 hours
vibe_[room]Recognizes an admitted room participant.Up to 30 days
vibe_control_[room]Recognizes the browser authorized to control a room.Up to 30 days
vibe_opener_[room]Authorizes the opening-act console where enabled.Up to 30 days

The application also recognizes the older vibestar_host host cookie for compatibility. Its own access cookies are HttpOnly and use SameSite restrictions, with Secure enabled on HTTPS. A cookie’s presence does not extend an expired room or guarantee continued authorization.

A deployment’s sign-in or hosting provider may set additional cookies. Those provider-specific details must be confirmed in the final inventory.

02

What stays in this browser.

Local storage remembers the active room, audience mode, sound and haptic preferences, and supported embedded-app state. Most keys begin with vibestarz-; older vibestar- values may be read for continuity.

This storage does not have the same automatic expiry as cookies. It can remain until cleared or replaced. Embedded prototypes currently save their supported local state in the surrounding browser; that is not a promise of cloud backup or cross-device syncing.

The audition form uses session storage to retain an unfinished draft in this browser tab. Submitting clears that draft and keeps a private receipt link in the tab. The link contains an access key: anyone with the complete link can manage the submission. Save it safely; no email recovery is currently provided.

Project pages remember your private support link in local storage under a project-support: key. Anyone with that link can manage that support record. Replacing its access key revokes the old link, including access by a connected assistant. Save the new link safely; no email recovery is available. Clearing browser storage does not leave the project or cancel backing with an external funding provider.

Downloaded or independently hosted versions of an app can behave differently. Check their own data practices.

03

Advertising and analytics.

No optional marketing or third-party analytics tracker was identified in the current application code review. This page therefore does not display a pretend preference switch for systems the app does not implement.

Infrastructure logs, authentication services, and third-party links are separate considerations. If non-essential tracking is introduced, the cookie inventory and any required consent controls need to be updated before it runs.

04

Managing stored data.

Use your browser’s site settings to inspect or delete cookies and storage for this origin. You can also block storage in your browser, although doing so can prevent signing in, joining, resuming a room, or saving prototype data.

Before clearing: save anything important. Clearing data can sign you out, lose a room’s control credential, and permanently remove local app changes. It does not delete votes, published apps, saved episodes, or records held on the server.

For a request concerning server-held information, see Your choices and requests.

05

Inventory and changes.

This draft inventory reflects the application code reviewed on October 6, 2026. The operator must verify cookies and storage against the actual deployment, including sign-in infrastructure, before adopting the notice. See Contact for publication status.