Cookie Policy

This page lists every cookie this website sets, and the similar browser-storage technology it uses, with each one’s name, purpose and lifetime. It supplements our Privacy Policy, which describes how we handle personal information more broadly. In short: we set only the cookies needed to make signing in and registering work. We set no analytics, advertising or tracking cookies of any kind.

Cookies are small text files the browser stores and sends back to us with each request. All of the cookies below are strictly necessary — the sign-in, registration and security functions of the site do not work without them — so they are set without asking first, as privacy law permits for essential cookies.

• 2.1

  sb-… (sign-in session). Set by our authentication system (Supabase) when you sign in to your account. The name begins with “sb-” followed by our project identifier, and the session may be split across a small number of numbered parts. It is what keeps you signed in as you move between pages. Lifetime: your session lasts up to 400 days, or until you sign out; the cookie is refreshed while you use the site and removed at sign-out.

• 2.2

  bp_workos_state (sign-in security). Set for the duration of a sign-in attempt when signing in through our hosted sign-in service. It carries a one-time security code that protects the sign-in round-trip against forgery, and nothing else. Lifetime: 15 minutes, and it is cleared as soon as the sign-in completes.

• 2.3

  bp_workos_sid (sign-out coordination). Set when you sign in through our hosted sign-in service (WorkOS). It remembers that sign-in session so that signing out of Blueprint also signs you out of the sign-in service — without it, “sign out” would not fully sign you out. It is not a credential and grants no access on its own. Lifetime: up to 400 days, cleared when you sign out.

• 2.4

  Hosting infrastructure (_vercel_…). Our hosting provider, Vercel, may set short-lived technical cookies of its own — for example on preview or access-protected deployments — for security, routing and load-balancing. These are infrastructure cookies, not tracking: they identify a deployment, not you, and Vercel does not use them to profile visitors. Lifetime: session or short-lived, controlled by Vercel.

We also keep a few pieces of information in your browser’s local storage. Unlike cookies, local storage is never sent to us automatically — it stays on your device until you clear your browser data.

• 3.1

  bp-cart-v2 (your cart). The contents of your shopping cart — the programs and riders you have selected. It stays in your own browser and is not sent to us until you check out. Lifetime: until you complete checkout or clear your browser data.

• 3.2

  bp-consent-v1 (this notice). Records that you have seen and dismissed our cookie notice, so it is not shown on every visit. It is written only when you dismiss the notice, and contains only a timestamp — the notice itself sets no cookies. Lifetime: until you clear your browser data.

• 3.3

  bp-admin-… (staff console). Display preferences for our staff console, which staff access on its own separate address: bp-admin-theme (light or dark mode), bp-admin-sidebar (sidebar collapsed or expanded), bp-admin-nav-pins and bp-admin-home-v1 (layout preferences). These exist only in staff members’ browsers and hold no client information.

We do not run any analytics, advertising, social-media or tracking product on this website. No third party sets cookies here to profile you, we do not use tracking pixels, and we do not sell or share personal information for advertising. If we ever adopt an analytics tool, we will update this page with a new version number first, and where the law requires consent for it, we will ask before setting anything that is not essential.

Most browsers let you view, block and delete cookies and local storage in their settings. You can browse this site with all cookies blocked — but because everything we set is essential, blocking our cookies means you will not be able to sign in or complete a registration, and clearing local storage will empty your cart and show the cookie notice again. Deleting the sb- cookie signs you out.

If the cookies or storage we use change, we will update this page before or alongside the change, with a new version number and date. The current version is always posted here.