Cookies
Every cookie and browser storage key this app sets, what each one is for, and how long it lasts. All of them are strictly necessary or a preference you chose.
Last updated 9 September 2026.
The short version
Messg sets three cookies and stores two preferences in your browser. The cookies keep you signed in and keep the app pointed at the right account. The preferences remember your reading size and that you have seen the cookie notice.
There is no analytics cookie, no advertising cookie, no tracking pixel and no third-party marketing script. Nothing here follows you to another site, and nothing here is shared with an advertiser. That is why the notice at the bottom of the page tells you what is set rather than asking you to choose: there is no non-essential category to turn off.
Cookies we set
All three are first party, sent only to messg.app, and marked so that scripts on the page cannot read them.
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
| sb-<project>-auth-token | Keeps you signed in. Set by our authentication provider (Supabase) when you sign in, and rotated as you use the app. It may be split across two cookies with a numeric suffix when the session is large. | Rotated while you use the app; removed when you sign out | Strictly necessary, first party |
| fm_setup | Records that this account finished setup, so the app does not re-check three tables on every page you open. It is a hint the server re-checks, and holds no personal data. | 24 hours | Strictly necessary, first party |
| fm_active_account | Remembers which account you switched to when you belong to more than one. Your membership of that account is verified on the server on every request, so the cookie by itself grants nothing. | 1 year, or until you sign out | Strictly necessary, first party |
Cookie: sb-<project>-auth-token
- Purpose
- Keeps you signed in. Set by our authentication provider (Supabase) when you sign in, and rotated as you use the app. It may be split across two cookies with a numeric suffix when the session is large.
- Lifetime
- Rotated while you use the app; removed when you sign out
- Type
- Strictly necessary, first party
Cookie: fm_setup
- Purpose
- Records that this account finished setup, so the app does not re-check three tables on every page you open. It is a hint the server re-checks, and holds no personal data.
- Lifetime
- 24 hours
- Type
- Strictly necessary, first party
Cookie: fm_active_account
- Purpose
- Remembers which account you switched to when you belong to more than one. Your membership of that account is verified on the server on every request, so the cookie by itself grants nothing.
- Lifetime
- 1 year, or until you sign out
- Type
- Strictly necessary, first party
Browser storage
These two are not cookies. They are kept in your browser's local storage and are never sent to our servers.
| Key | Purpose | Lifetime | Type |
|---|---|---|---|
| messg.text-scale | Remembers the reading size you chose (A, A+ or A++), so text stays the size you set it. | Until you clear your browser data | Preference, stored locally |
| messg.cookie-notice | Remembers that you dismissed the cookie notice, so it is not shown again on this browser. | Until you clear your browser data | Preference, stored locally |
Key: messg.text-scale
- Purpose
- Remembers the reading size you chose (A, A+ or A++), so text stays the size you set it.
- Lifetime
- Until you clear your browser data
- Type
- Preference, stored locally
Key: messg.cookie-notice
- Purpose
- Remembers that you dismissed the cookie notice, so it is not shown again on this browser.
- Lifetime
- Until you clear your browser data
- Type
- Preference, stored locally
What we do not use
- No advertising or retargeting cookies.
- No third-party analytics, and no cross-site tracking.
- No social media pixels or embedded trackers.
- No selling or sharing of anything in this list.
We do measure how fast pages load, using Vercel Speed Insights on our own hosting. It reports page timings, not people: it sets no cookie and writes nothing to your browser storage.
Signing in with Google, and connecting a Gmail mailbox, both take you to Google's own pages, where Google sets its own cookies under its own policy. What we then do with the mailbox is set out in the privacy policy.
Managing them
Every browser lets you clear cookies and local storage, or block them for a site. Blocking them here is allowed and the app will still render, but the sign-in cookie is what keeps you signed in, so with cookies blocked you will not be able to stay in your account. The two preferences simply stop being remembered.
Signing out removes the session cookie and the account cookie. Clearing site data removes the two preferences as well.
Questions: privacy@messg.app.