Legal
This page lists every cookie and browser storage key EuroScout Pro relies on, what each one is for, how long it lasts, and whether it needs your consent.
Version 2026-09-11
A cookie is a small file a site stores in your browser and receives back on later requests. Local storage works similarly but stays in your browser and is never sent to us automatically. We use both, and this policy covers them together. Cookies that are strictly necessary to deliver a service you asked for — keeping you signed in, remembering your language, protecting your account — do not require consent. Anything optional does, and is only used once you accept.
Legal basis
No consent required. These are essential to provide a service you have asked for, and the platform cannot keep you signed in without them.
These identify your session and keep players, clubs and staff signed in securely as they move between pages.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| sb-<project>-auth-token (and -token.0 / -token.1 chunks) | Your Supabase authentication session — the signed token that proves who you are on each request. Split across numbered cookies when the token is too large for one. | Until sign-out, or up to 1 year | First party |
| sb-<project>-auth-token-code-verifier | Short-lived value that completes a secure sign-in exchange (PKCE), including sign-in with Google. | Minutes — deleted once sign-in completes | First party |
| euroscout-recovery | Signed marker proving a password-reset link was genuinely issued by us before a new password is accepted. | 20 minutes | First party |
Legal basis
No consent required. These protect your account and the platform from forged requests, scraping and automated abuse.
EuroScout Pro protects form and action submissions by validating the origin of every request and by restricting cookies to same-site use, rather than by issuing a separate CSRF token cookie. Two signed, short-lived cookies carry state that must not be tampered with. Bot detection, scraper blocking and rate limiting are handled from request data — principally your IP address — and from our hosting provider's edge protections; these do not set a cookie on your device, but the IP processing involved is described in our Privacy Policy.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| esp_pending_legal_consent | Carries the Terms and Privacy versions you accepted across a sign-up redirect so your consent is recorded accurately. Signed, and limited to the sign-in callback path. | 15 minutes | First party |
| Vercel infrastructure cookies (e.g. _vercel_jwt and routing or load-balancing values) | Set by our hosting provider to route your request to the right region and server, keep responses consistent, and gate access to preview deployments. | Session to short-lived, set by the provider | Third party |
Legal basis
No consent required. These only remember settings you have chosen, and exist so we do not have to ask you again on every visit.
Some of these are cookies; the rest are stored in your browser's local storage, which behaves similarly but is never sent to our servers.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| NEXT_LOCALE (cookie) | The interface language you selected. | 1 year | First party |
| euroscout-cookie-consent (local storage) | Records whether you accepted or declined optional analytics, so the banner is not shown again on every page. | 180 days, after which you are asked again | First party |
| euroscout-theme (local storage) | Light or dark appearance. | Until cleared | First party |
| euroscout-tour:*, push-prompt-dismissed, film-upload-guide-dismissed (local storage) | Remembers that you finished or dismissed a product tour, the notification prompt, or the film upload guide. | Until cleared | First party |
Legal basis
Consent required. Nothing in this group is used to capture your activity unless you choose "Accept all" in the cookie notice, and you can withdraw that at any time.
These help us understand which parts of the platform are actually used — profile views, film clicks, messages sent, call bookings — so we can improve them. Analytics data is not sold and is not used to advertise to you. Note that our analytics provider is served through our own domain, so its cookies are set as first-party cookies.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| ph_<token>_posthog (PostHog) | Distinguishes one browser from another so product usage can be measured. Only used to capture activity after you accept. | 1 year | First party (proxied) |
| Vercel Analytics | Aggregated page-view measurement. Loaded only after you accept. | Session | Third party |
Legal basis
Loaded for all visitors. We consider this necessary to keep the service working acceptably, and it does not identify you.
We measure how quickly pages load and respond so we can find and fix slow pages. This collects performance timings and coarse device and connection information — not your identity, and not your activity across other sites. If you would prefer this were gated behind consent as well, tell us at info@euroscoutpro.com and we will treat it as feedback on this policy.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| Vercel Speed Insights | Page-load and responsiveness timings used to diagnose performance problems. | No persistent identifier is stored on your device | Third party |
Legal basis
These load when you open a feature that uses them, not when you first arrive. They are controlled by those providers under their own policies.
Parts of EuroScout Pro embed services we do not control. When a page containing one loads, or when you use that feature, the provider can set its own cookies or storage and will see your IP address. We are working towards holding these embeds behind an explicit click for visitors who decline optional cookies; until then, this is what they are and when they appear.
| Name | Purpose | Duration | Set by |
|---|---|---|---|
| YouTube / Hudl (film and highlight players) | Plays embedded film on player and club profiles. Set by the video provider when a profile containing film is viewed. | Set by the provider | Third party |
| Google Maps | Shows a club's location on its profile. | Set by the provider | Third party |
| Daily.co | Runs the video call rooms used for recruitment calls. Loads only when you join a call. | Set by the provider | Third party |
| Stripe (__stripe_mid, __stripe_sid) | Fraud prevention and payment processing, when you open checkout or the billing portal. | __stripe_mid 1 year, __stripe_sid 30 minutes | Third party |
You can change your analytics choice at any time using the “Cookie settings” link in the footer of every page. Declining optional cookies does not restrict access to any part of the platform. You can also block or delete cookies in your browser settings — but blocking the strictly necessary ones listed above will stop you from being able to sign in.
Questions about this policy, or about anything listed on this page, can be sent to info@euroscoutpro.com.