Halaal
Cookie Policy
We use strictly necessary cookies to keep your workspace secure, plus a few first-party functional cookies that are written only when you take an action (such as signing in or submitting a form). We do not use advertising or analytics cookies on public profiles, forms, or signage displays.
Overview
This policy applies to the entire Workspace ecosystem, including but not limited to:
Everything we store falls into two buckets: strictly necessary cookies (for authentication, security, and keeping a signage screen working offline), and a few first-party functional cookies that are written only in direct response to an action you take — for example remembering your last-used workspace after you sign in, or noting that you have already submitted a form. These exist solely to make the feature you asked for work; none of them track you across sites, and we run no advertising or analytics cookies — our usage statistics are cookieless by design: we count visits to a page, never the people making them. When you open a link someone shared with you, which share it was travels in the link itself and is read by that page only — nothing about it is stored on your device, and closing the tab forgets it. Because we set no advertising, analytics, or cross-site tracking cookies, we do not show a cookie-consent banner. If we ever introduce genuinely optional or tracking cookies, we will ask for your opt-in consent first and make refusing them as easy as accepting. You can review or clear any of the above at any time via your browser (see Managing Cookies). For how we handle personal data more broadly, see our Privacy Policy.
Cookie Categories
We use the minimum amount of storage required to run our platform securely.
Authentication & Session
Essential for keeping you signed in. Without these, you would be logged out on every page refresh.
Security & Anti-Abuse
Used to detect bots (via Cloudflare Turnstile), prevent spam on forms, and enforce rate limits to protect our servers.
Preferences
Stores local choices like 'Dark Mode' or your last active workspace. These do not track you across the web.
Zero Tracking
We do not use third-party advertising cookies, behavioral profiling, or cross-site analytics pixels.
| Cookie / token | Provider | Purpose | Retention |
|---|---|---|---|
| sb-<ref>-auth-token (First-party cookie · strictly necessary) | Supabase | Keeps you signed in. Set via @supabase/ssr — scoped to .halaalos.com (.halaal.app on our former addresses), SameSite=Lax, Secure. | Session / until sign-out |
| __cf_bm (Third-party cookie · strictly necessary) | Cloudflare | Bot-management token that distinguishes automated traffic from real visitors. | ~30 minutes |
| cf_clearance / Turnstile (Third-party cookie · strictly necessary) | Cloudflare | Records that an anti-bot / security challenge (including Turnstile) was passed. | Up to ~1 year |
| last_used_tenant_<userId> (First-party cookie · functional) | Halaal | Written after you sign in, to route you back to your last-used workspace. | 30 days |
| form_submitted_<id>_<version> (First-party cookie · functional) | Halaal | Written only after you submit a public form, to prevent duplicate submissions. Not used for tracking. | 1 year |
| halaal_buyer (First-party cookie · functional) | Halaal | Written only after you confirm a shop order from the email we send, so your next order from this device does not need confirming again. It holds that one address, signed, and nothing else. | 6 months |
| theme / preferences (Local Storage · functional) | Halaal | Remembers local choices such as dark mode. Stored on your device; not used to track you. | Persistent (local) |
| shop basket & recently viewed (Local Storage · functional) | Halaal | On a shop, keeps your basket and the last few products you looked at on your device, so they are there when you come back. Never sent to us or to the shop. | Until cleared / replaced |
| where this visit came from (Session Storage · functional) | Halaal | On a public page (a shop, a form, an event, a bio), notes where the link you followed came from, such as “Instagram” or “a poster”, so an order, answer or sign-up made in the same tab can tell the organisation which of its links is working. It holds nothing that identifies you, and is never sent anywhere by itself. | Until the tab is closed |
| signage offline cache (Local Storage + service worker · strictly necessary) | Halaal | On digital-signage displays, keeps the last content so the screen keeps working if the network drops. | Until cleared / replaced |
Cookie names are indicative; exact identifiers set by Supabase and Cloudflare may vary by version. The functional cookies above appear only after the related action (signing in, submitting a form, or confirming an order).
Payments & checkout
When you upgrade or pay, we hand you off to our Merchant of Record, Lemon Squeezy (United States). Their checkout pages set their own cookies under Lemon Squeezy's own cookie and privacy policies, which we do not control.
When you pay a shop by card, you go to Stripe Checkout, the seller's payment page run by Stripe. Stripe sets its own cookies there, under its own cookie and privacy policies, which we do not control. We do not load Stripe's scripts on our own pages.
Managing Cookies
You can clear or block cookies via your browser settings (Chrome, Safari, Edge, etc.).
Questions?
If you have concerns about a specific cookie or our data practices, please reach out.
Contact privacy@halaal.appData controller: Halaal Inc LTD, registered in England & Wales (company no. 16055333), 167–169 Great Portland Street, London, W1W 5PF. Cookie and privacy queries: privacy@halaal.app.