Pluto / Legal

Cookie policy

Sign-in cookies, browser preferences and how you can control them.

Draft revised 6 September 2026

1. About device storage

This policy covers cookies and similar technologies used by Pluto, operated under the name Plutoweb in the United Kingdom. Contact plutoplayfeedback@gmail.com with questions.

Cookies are stored by your browser and sent with relevant requests. Local storage is read by website code rather than automatically attached to requests. Device-storage rules can apply to both.

The current application uses authentication cookies and local preferences. It does not load analytics, advertising pixels or Google sign-in. “Got it” acknowledges the notice; it does not authorise optional tracking.

2. Storage inventory

Authentication session

Names and technology: sb-*-auth-token, potentially split into numbered cookie chunks. The asterisk represents the Supabase project identifier.
Provider and purpose: Supabase authentication, on the application domain. Maintains the session required to sign in and make authenticated requests.
Duration: Persistent, not just a browser-session cookie. The installed helper requests a long-lived expiry, which browsers may cap. Refreshes can renew it. Sign-out removes local authentication cookies; browser settings can also remove them. Token validity is separate from cookie expiry.
Requirement: Necessary for the authenticated service you request.

Authentication verification

Name and technology: sb-*-auth-token-code-verifier cookie, when required by a verification flow.
Provider and purpose: Supabase. Links verification to the browser that initiated it.
Duration: Removed when consumed by the flow. An abandoned flow can leave it until persistent expiry or browser deletion; closing the browser is not guaranteed to remove it.

Notice acknowledgement

Names and technology: pluto_cookie_consent and pluto_cookie_consent_ts in local storage.
Provider and purpose: Pluto. Remembers dismissal and its timestamp. The legacy names do not mean that optional tracking consent was obtained.
Duration: No automatic expiry. Remains until reset, site-data removal or browser eviction.

Installation preference

Name and technology: pluto-a2hs-dismissed-at in local storage.
Provider and purpose: Pluto. Written when you dismiss the installation prompt, to remember your choice.
Duration: Suppresses the prompt for 14 days. The timestamp itself is not automatically deleted after that period; it remains until replaced or cleared.

These local preferences respond to your dismissal action and are not used to follow you across websites. Production hosting and security infrastructure still require verification before this inventory is final; no additional infrastructure cookies have been verified for this draft.

3. Your controls

Use your browser’s site-data settings to block or remove cookies and local storage. Blocking authentication cookies disrupts sign-in. Removing preferences can cause notices to appear again.

The button below clears only the two notice preferences. It does not sign you out, delete account information or withdraw permission for a tracker; no optional tracker is activated by this notice.

Sign out to remove your local authentication session. Use account deletion in Profile settings to remove server-held records. See the Privacy policy for details.

4. Optional technologies and updates

Storage strictly necessary for a service you request can be exempt from prior-consent requirements under applicable storage rules. That does not remove privacy-law obligations. A preference’s legal treatment depends on its actual purpose; not all convenient storage is essential.

Any future analytics, advertising or other consent-requiring technologies must stay off until valid consent, with an accessible way to refuse and withdraw it. Updating this policy or dismissing the existing notice is not such consent.

We will update the inventory when storage behaviour changes. Contact plutoplayfeedback@gmail.com with concerns.