This Policy explains how GarageSeeker uses browser cookies and browser storage on the GarageSeeker website. Cookies and local storage are different technologies. The current GarageSeeker application primarily uses local storage and does not use first-party cookies for its normal account sessions.
1. Cookies and local storage
A cookie is a small text value that a website or third party asks a browser to send with later requests. Local storage is a separate browser feature that keeps values on the device and does not automatically send them with every request. GarageSeeker sends its access token in an authorization header only when making an authenticated API request.
2. Local storage used by GarageSeeker
access_token, refresh_token, and compatible legacy keys store JWTs issued by GarageSeeker after password or Google sign-in. The access token is configured to expire after 30 minutes and the refresh token after 7 days. The stored values remain on the device until they are replaced, you sign out, the application clears them after expiry or an authentication failure, or you clear browser site data. An expired token cannot be used to extend its configured lifetime.garage_seeker_last_activity, garage_seeker_session_started, andgarage_seeker_session_ended contain timestamps or a sign-out reason. They support inactivity warnings, automatic sign-out, and sign-out synchronization between open tabs. Regular accounts are signed out after 30 minutes of inactivity, administrator accounts after 15 minutes, and all sessions have a maximum duration of 7 days. The active-session timestamps are cleared on sign-out. The cross-tab session-ended signal is replaced or removed at the next session initialization.user_location key stores the latitude, longitude, and display label selected by the user or obtained after the user grants browser geolocation permission. It is used to calculate nearby shops and remains until the user selects Clear location or clears browser site data.is_shop_owner_flag and owned_shop_ids keys help the interface display shop-owner controls without unnecessary delay. They do not grant ownership or permissions; the server remains the authority. These values are updated from account data and may remain until updated or browser site data is cleared.saved_shops_sync key stores only a timestamp used to tell other open GarageSeeker tabs to refresh saved shops. The saved-shop list itself is associated with the signed-in account on the server and is not stored in this browser key.3. Cookies and analytics currently used
GarageSeeker does not currently integrate Google Analytics, Vercel Web Analytics, advertising pixels, or behavioural advertising trackers. The GarageSeeker frontend and API do not intentionally set first-party cookies for GarageSeeker account authentication; they use the local-storage JWT process described above. A production browser audit completed on October 4, 2026 found no analytics, advertising, profiling, or session-replay requests and no GarageSeeker cookies on the home, registration, shop-listing, privacy, or cookie-policy pages. The application does not currently use browser session storage.
Because no optional analytics, advertising, or profiling technology currently runs, GarageSeeker does not display a cookie-consent banner that would imply a choice where none is needed. Before introducing any such technology, GarageSeeker will update this Policy, prevent the technology from loading until any required consent is obtained, and provide a way to withdraw that consent.
4. Google sign-in
When Google sign-in is configured, the login page first displays a GarageSeeker button labelled "Continue with Google". Only after you select it does GarageSeeker load Google Identity Services to display Google's account sign-in button. Simply opening the login page does not load this library. Once loaded, the library contacts accounts.google.com and may use Google cookies, browser storage, an existing Google account session, or the browser's Federated Credential Management feature.
g_state (Google Identity Services)The Google library may set this cookie on the GarageSeeker domain after you choose to load Google sign-in, including before you finish signing in. Google documents it as sign-out state used to prevent an automatic sign-in loop. An earlier production audit on October 4, 2026, before loading was made optional, observed it with a six-month expiry. Its exact expiry and use may vary with Google's library and browser configuration. It is used for the Google sign-in feature, not by GarageSeeker for analytics or advertising.Google controls the library's cookie implementation, but GarageSeeker controls whether the library is loaded. Users who do not choose Google sign-in can use standard username and password sign-in without loading this library. Choosing Google sign-in does not enable advertising or analytics. Cookies from a previous Google sign-in attempt may remain until they expire or you clear them. Blocking Google or clearing g_state may affect only the Google sign-in experience.
After the user chooses a Google account, Google provides a short-lived identity credential to the login page. GarageSeeker sends it to the backend to verify the sign-in. The Google credential is held temporarily in page memory when registration acceptance is required and is not saved by GarageSeeker in local storage. After a successful exchange, GarageSeeker stores its own access and refresh JWTs as described in section 2. Google sign-in does not give GarageSeeker the user's Google password.
5. Other service providers
Hosting providers receive ordinary request information needed to deliver the frontend and API. Geocoding, email, and SMS providers are contacted by the GarageSeeker backend for requested features; the repository does not load their analytics or tracking SDKs in the browser. Their handling of request or account information is described in the Privacy Policy and their own policies, but these backend integrations should not be confused with GarageSeeker setting browser cookies.
6. Your controls
- Signing out removes GarageSeeker authentication tokens and active-session timestamps from local storage.
- The location menu provides a Clear location control for the stored location.
- Browser settings can inspect or clear GarageSeeker cookies and local storage.
- Blocking local storage will prevent sign-in persistence and may prevent account features from working.
- Blocking Google cookies or federated sign-in may prevent Google sign-in. Standard sign-in remains available to accounts that have a GarageSeeker password.
7. Updates and contact
We may update this Policy when browser storage practices, service providers, or legal requirements change. The date above identifies the current version.
1435 Celebration Dr #1010
Pickering, ON L1W 0C4
Canada