Cookies & storage
Effective November 3, 2026. Exegetical uses necessary browser storage to keep the service working. It does not use advertising or analytics cookies. Vercel Web Analytics and Speed Insights measure aggregate visits and performance without analytics cookies. See the privacy notice for the data involved.
Sign-in cookies
Supabase’s browser authentication client writes cookies whose names begin with sb-. They hold the session information needed to recognize your signed-in browser and refresh an expired access token. On this HTTPS site they use Secure and SameSite=Lax settings and a rolling maximum age of approximately 30 days. A session may end sooner if you sign out, clear cookies, use private browsing, revoke access or the authentication provider ends the session.
The browser authentication library must read these cookies, so they are not HttpOnly. Keep shared devices secure. We never put your password in these cookies. Server-side operations verify your authenticated identity; a cookie value alone is not treated as permission to access another person’s data.
Local storage
Keys beginning with exegetical- store guest notes, highlights, reading settings and account-specific cached study records and pending changes. These records can remain after sign-out so unsynced work is not lost, but account caches are kept separate from guest data and from other accounts. Anyone with access to your browser profile may be able to inspect local storage. Delete site data on a shared device when you are finished, after exporting anything you need.
Older versions used Supabase local-storage session tokens. Where possible, an existing session is moved to sign-in cookies when this version opens, then the old token is removed. External Bible data may be cached to speed up reading; ESV and API.Bible text bypass the application’s accumulation cache and are not included in account exports.
API.Bible view reporting
When you display an API.Bible translation, its required FUMS tracker stores anonymous device and session identifiers and reports Scripture-view tokens. This reporting is separate from optional Vercel measurement. Choose an AO Lab or Crossway translation if you prefer not to load the API.Bible tracker; a tracker already loaded remains active until you reload the page.
Your choices
Sign out through My account to end the browser’s session. Browser settings let you delete or block cookies and local storage. Blocking them can prevent persistent sign-in, local notes and offline recovery. Private browsing generally forgets this data when the private session closes. Optional usage and performance measurement can be disabled for this browser below. The choice is saved in local storage as exegetical-analytics-disabled. Global Privacy Control and Do Not Track also prevent our measurement scripts from loading. This does not disable necessary sign-in storage. See the Privacy notice for account data controls.