Last updated 7 October 2026
Cookies & browser storage
We don't use advertising or cross-site tracking cookies, and no third-party analytics are built into the app. Most items below are needed for security, sign-in or the site to work.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| __cf_bm | Cookie (Cloudflare) | Bot and abuse protection for the website. | About 30 minutes |
| __dpl | Cookie (hosting) | Routes your browser to the current version of the site. | Session / set by the host |
| session-id | Cookie (Lovable hosting analytics) | Groups page views into a visit for aggregate site statistics (page, browser, language, approximate country). Not used for advertising. | 30 minutes |
| sb-…-auth-token | Local storage (sign-in) | Keeps you signed in after you sign in. | Until you sign out |
| bc.application.draft / bc.invite.token | Local storage (app) | Saves your unfinished application and an invitation code on your own device. | Until submitted or cleared |
| Service worker cache | App cache | Lets public pages (home, eligibility, FAQ, standards, privacy, terms) open offline. Member pages and data are never cached. | Up to 7 days |
About the hosting analytics
Our hosting provider, Lovable, adds a small script (/~flock.js) that records page visits so the operator can see aggregate traffic. It sets the short session-id cookie above. It is part of the hosting platform rather than our app code. The operator can turn it off in the hosting settings; until this notice says it is off, assume it may be running. You can block it with your browser's cookie settings or a content blocker without affecting the site.
See the privacy notice and service providers.