What cookies do
Cookies are small pieces of information stored by your browser and sent with relevant requests. Buk Capital LLC uses them for Inbound Booking's authentication and security functions. This policy should be read with our Privacy Policy, which explains the wider handling of personal information.
The current application does not install advertising cookies, cross-site marketing pixels, or optional analytics cookies. We do not currently provide an optional cookie consent selector because the application cookies described here support requested account or integration functions. If we introduce optional technologies that require consent, we will provide the appropriate information and controls before using them.
Authentication and session cookies
Supabase authentication uses first-party cookies on our site to keep you signed in, refresh your session, and make authenticated requests. Their names are generated for the Supabase project and commonly begin with sb-; a value may be split into numbered cookie chunks. A temporary authentication verifier may also be used to complete a secure sign-in or recovery flow.
These are functional account cookies, not advertising identifiers. Some persist beyond a browser session and can be renewed while you use the account. Their presence does not guarantee that a server-side session remains valid. Signing out clears the applicable authentication cookies; you can also remove them using your browser settings. Blocking them can prevent login, account access, or recovery from working.
Support conversation cookie
When you open website support chat as a guest, we set __Host-ib_support, a first-party Secure, HttpOnly, SameSite=Lax cookie with a maximum age of 30 days. It contains a random credential, not your messages or contact details. We store only its hash in the support database to let this browser return to its private conversation.
Messages and callback requests are saved in Supabase. When a guest conversation is linked to your signed-in account, its guest credential is revoked and the cookie is cleared. Clearing the cookie ends this browser’s guest access; it does not delete messages already submitted. Contact us for help with access or deletion requests.
Google connection security cookie
When you start connecting Google Calendar or Microsoft, we set __Host-ib_google_state or __Host-ib_microsoft_state respectively to link the returning authorization request to the browser that started it. This protects against an unauthorized or mismatched connection. The cookie is marked Secure and HttpOnly, uses SameSite=Lax, applies to this site's root path, and has a ten-minute maximum age. The callback clears it when the connection attempt returns.
The cookie contains a temporary random state value, not your Google refresh token or calendar content. Google authorization occurs on Google's own service, which may use separate cookies under Google's policies.
Other services and technical records
If you visit Google to authorize a calendar connection or Stripe to complete checkout or manage billing, those services control their own pages and storage. Their cookies are governed by their policies and choices. Email and telecommunications providers may also process delivery or security information. A website cookie preference does not change those separate records or cancel a text message permission.
Hosting and security providers may use technical controls and logs needed to deliver or protect the website. Network logs, such as a request timestamp or IP address, are not necessarily cookies and are covered by the Privacy Policy. The fonts used by the current website are served with the site, rather than requiring a visitor's browser to fetch a Google Fonts stylesheet.
Browser controls and privacy signals
You can inspect, block, or delete cookies through your browser's privacy and site-data settings. Controls vary by browser and device, and clearing one browser does not clear another. Removing essential cookies may sign you out or interrupt a pending calendar authorization. It does not delete account records, cancel a subscription, or revoke Google's authorization; use the relevant account controls or contact us for those actions.
Our application does not change its behavior in response to the legacy Do Not Track setting. Where applicable law requires a recognized universal opt-out preference signal, such as Global Privacy Control, to be honored for a covered activity, we will respect that requirement. The current service does not sell personal information or use it for cross-context behavioral advertising. We cannot make a site-wide promise about how an independent provider responds to every browser signal on its own pages.
Updates and questions
We will update this page when our cookie practices materially change. Contact Buk Capital LLC at hello@inboundbooking.com if you have questions about cookies or need help understanding a cookie associated with Inbound Booking.