Cookie Policy
Every cookie, named and explained.
Most cookie policies describe categories of cookie in the abstract and hope you stop reading. This one lists what Freeborn actually stores on your device, under what name, for how long and why. There are no advertising cookies, no cross-site trackers and no analytics cookies, so there is no consent banner: everything below is either strictly necessary to keep you signed in, or a preference you set yourself.
Version 1.1 · Effective 13 November 2026
1The summary
What is on your device
- Cookies: authentication cookies set by our auth provider so your session survives a page reload. Nothing else.
- localStorage: five keys holding your own preferences, plus the session copy the browser client uses.
- sessionStorage: two keys that vanish when you close the tab.
- A service worker: registered so the site is installable. It caches nothing.
- No advertising cookies. No third-party analytics. No tracking pixels. No ad networks.
2Cookies we set
All cookies on Freeborn are set by the authentication layer. Their names begin with sb- followed by our project identifier. A long session value is split across numbered parts, so you may see more than one.
| Cookie | Purpose | Lifetime | Attributes |
|---|---|---|---|
sb-…-auth-token | Keeps you signed in. Holds your session so you do not have to authenticate on every page. | Session-scoped, refreshed automatically. Signing out clears it immediately. | Secure; SameSite=Lax in production; Path=/ |
sb-…-auth-token.0, .1 | Continuation parts of the same session value when it exceeds a single cookie's size limit. | Same as above. | Same as above. |
SameSite=Lax in production means the browser will not attach your session cookie to a cross-site request. That is a deliberate cross-site request forgery control. It is set toNone only in local development, where an embedded preview frame needs it.
One limitation we are not going to hide
These cookies are not marked HttpOnly, which means a script running on a Freeborn page could read them. That is the documented default of the authentication library we use, and it is not an oversight we can simply switch off: the browser client reads the session in order to attach bearer tokens to API requests, and the session is also persisted in localStorage for the same reason. Marking the cookie HttpOnly alone would not remove the exposure, because the localStorage copy would remain.
The controls that actually matter here are working. Freeborn loads no third-party scripts at all, which removes the way most script injection reaches a site in the first place. A Content Security Policy is enforced on every response and allowlists the origins the page may connect to, so even script that did manage to run would have nowhere to send a session token. The same policy blocks this site from being framed, from posting a form to another origin, and from loading plugins. What it does not do is block an injected inline script, because these pages are pre-rendered at build time and cannot carry the per-request secret that would allow it. We are describing the limit rather than claiming a protection we do not have. If you find a way to run script on this site, tell us at support@freeborndating.com and we will treat it as a security report.
3localStorage: your preferences
localStorage persists after you close the browser. Every key below stores something you chose, on your own device, and none of it is transmitted to us as a tracking identifier.
| Key | What it holds | Why |
|---|---|---|
freeborn.preferences | Your notification preferences. | So the alerts you turned off stay off. |
freeborn.filters | Your discovery filters: age range, distance, genders shown, intentions, verified-only. | So your settings are already applied when you open the deck. |
fb-notif-asked | Whether we have already asked for browser notification permission. | So you are asked once and never nagged again. |
fb-seen-alerts | How many alerts you have already seen. | So the unread indicator is accurate. |
fb-verify-invite-shown | Whether the invitation to verify your identity has been shown. | So it appears once rather than every session. |
session keys (sb-…) | The browser client's copy of your session. | So API calls can be authenticated. See the limitation in clause 2. |
4sessionStorage: cleared when the tab closes
| Key | What it holds | Why |
|---|---|---|
fb-security-checked | A timestamp of the last routine security check. | So the check runs at most once per interval rather than on every navigation. |
freeborn.origin | Your location fix for the current session. | So distances keep working without re-requesting GPS on every screen. |
Neither survives the tab. Neither is a tracking identifier and neither is readable by another site.
5The service worker
Freeborn registers a service worker so the site can be installed as an app on your home screen. It is deliberately minimal: it is a network passthrough. It does not cache your content, it does not store anything for offline use, and it does not intercept requests to add tracking. Removing it costs you the install prompt and nothing else.
It is not a cookie and does not appear in cookie settings, so to remove it use your browser’s site data controls, described in clause 7.
6What we deliberately do not use
- Advertising cookies or advertising networks of any kind.
- Third-party analytics. There is no Google Analytics, no Meta Pixel, no TikTok Pixel, no Hotjar, no Clarity and no PostHog on this site.
- Cross-site tracking or fingerprinting.
- Social media widgets that set cookies before you interact with them.
- Retargeting audiences or lookalike audiences built from your data.
- Any cookie set by a domain other than the one you are visiting.
Because nothing here needs consent under the ePrivacy Directive or the UK Regulations, there is no cookie banner. Everything is either strictly necessary to keep you signed in or a preference you set. A banner asking you to accept strictly necessary storage would be theatre.
7How to control and remove all of it
Every browser is different, but all of them give you the same three controls:
- Delete the cookies. In your browser’s privacy or site-data settings, clear cookies and site data for this domain. You will be signed out and your filters and notification preferences will reset.
- Block cookies. You can block cookies for this domain entirely. The site will load and you can read the public pages, but you will not be able to stay signed in, so the product will not work.
- Clear storage. The same site-data control removes localStorage, sessionStorage, the service worker and any cached files in one action.
- Private or incognito windows discard all of it automatically when the window closes.
To delete your data from our servers rather than your device, that is a different action: Settings, danger zone, delete account. It is described in the Privacy Policy.
8Changes and contact
Version 1.1, effective 13 November 2026. Version 1.0 was first published on 19 October 2026; 1.1 changes only the name of the operator and the contact address, not one cookie. If we add anything that stores data on your device, this page gets updated in the same change, and if it is not strictly necessary we will ask you first.
Questions: support@freeborndating.com.