Cookie Policy

Effective & last updated: October 10, 2026

The short version: this site sets zero cookies, and loads no analytics, advertising, or tracking script of any kind. The table below is the complete, itemized result of auditing the site's source code — every script tag, every localStorage call, and every third-party resource it loads — not a generic template. If that ever changes, the new item will appear in this table on the day it ships, and (per Section 3) it will not run until you've said yes. The optional account feature added on October 2, 2026 stores a sign-in session in localStorage — only if you sign in, and only to keep you signed in (see the rows marked "only if you sign in").

1. What "cookies" means here

A cookie is a small piece of data a website asks your browser to store and send back on future requests, typically used to remember who you are or to track you across visits or sites. This policy also covers localStorage, a similar browser storage mechanism that, unlike a cookie, is never automatically sent back to a server — it just sits in your browser until a script on the page reads it. Regulators (including under Israeli law and the EU's ePrivacy rules that GDPR consent practice follows) treat both the same way when used for tracking, so we disclose both here even though Alpha Desk only uses the second, and only for a non-tracking purpose.

2. Full inventory — every storage item and third-party resource on this site

Item	Type	Purpose	Consent required?
Cookies of any kind	None found	N/A — no cookie is set anywhere in the site's code.	N/A
`ad_view_mode`	localStorage — functional	Remembers whether you last used "simple" or "full" card view, on your device only. Never transmitted to us.	No — strictly necessary for the display preference you set yourself.
`ad_daily_mode`	localStorage — functional	Remembers whether "daily mode" is toggled on, on your device only. Never transmitted to us.	No — strictly necessary for the display preference you set yourself.
`ad_cookie_consent_v1`	localStorage — functional	Remembers the choice you make in the cookie banner on this page, so it doesn't ask again every visit.	No — recording your consent choice cannot itself require consent.
`sb-avcfcspcvvtrtpithycf-auth-token`	localStorage — strictly necessary	Only if you sign in. Holds your sign-in session so you stay signed in to your account ("My Desk"). It is sent only to our authentication provider (Supabase), to prove the requests are yours. Removed when you sign out.	No — it exists only because you asked to sign in, and the account cannot work without it.
`ad_my_desk`	localStorage — functional	Only if you sign in. Remembers whether you last viewed your own desk or the full dashboard. Never transmitted.	No — strictly necessary for the display preference you set yourself.
`supabase-js` (cdn.jsdelivr.net)	Third-party script — functional	Only if you open the sign-in window or already have a session. The sign-in library. Pinned to one version and integrity-checked. jsDelivr sees the request for the file, like any CDN.	No — loaded only on your own action, to provide the sign-in you asked for.
Google sign-in button (accounts.google.com)	Third-party script — functional	Only when you open the sign-in window. Google's official "Continue with Google" button. It runs in a Google frame that may read Google's own cookies to recognise a Google account already signed in on your browser; this site sets no cookie for it and receives nothing unless you sign in with Google.	No — loaded only on your own action, to provide the sign-in you asked for.
`html2canvas` (cdnjs.cloudflare.com)	Third-party script — functional	Only when you export a stock card. Runs locally in your browser to generate the PNG image. Sends nothing anywhere; Cloudflare sees the request for the script file itself (see Section 3).	No — no tracking behaviour, purely functional code execution.
`marked.js` (cdnjs.cloudflare.com)	Third-party script — functional	Only when you open an investigation. Runs locally in your browser to render the write-up from Markdown into HTML. Sends nothing anywhere; Cloudflare sees the request for the script file itself (see Section 3).	No — no tracking behaviour, purely functional code execution.
Analytics / measurement scripts	None found	N/A	N/A today — would require opt-in consent (Section 3) if ever added.
Advertising / retargeting pixels	None found	N/A	N/A today — would require opt-in consent (Section 3) if ever added.

3. Third-party CDN requests (not cookies, disclosed anyway)

Loading html2canvas and marked.js from Cloudflare's public CDN (cdnjs.cloudflare.com) means your browser makes a direct request to Cloudflare for those two files, the same as it would for any resource hosted off-site. Neither is requested when a page loads: html2canvas only the first time you export a stock card, and marked.js only the first time you open an investigation. That request necessarily exposes your IP address and browser user-agent to Cloudflare, exactly as it would to any server you request a file from — this is a property of how the web works, not tracking behaviour added by this site. Neither script reports back to us, sets a cookie, or reads/writes anything beyond the page you're on. See Cloudflare's Privacy Policy for how they handle that request on their end.

4. How consent works on this site

Because nothing on this site currently requires consent, the banner you may have seen is forward-provisioned rather than strictly necessary today: it records a preference now so that if we ever add an optional category (for instance, a future analytics tool), that category loads only for visitors who have already said yes — it does not retroactively ask permission after the fact. This is enforced in code (cookie-consent.js): any future non-essential script would be registered through a gate that queues it until consent is granted, rather than being placed directly on the page.

"Accept All" — records that you're open to optional categories being enabled in the future (there are none active today, so this has no visible effect right now).
"Necessary Only" — records that you want only strictly necessary local storage; any future optional category stays off for you until you change this choice.

Your choice is stored locally in ad_cookie_consent_v1 and is never sent to us.

You can review or change your stored choice at any time — this reopens the same banner shown on your first visit.

5. Changes to this policy

If a non-essential cookie, analytics tool, or tracking script is ever added to this site, this page will be updated on the same day, the inventory table above will list it by name, and it will be gated behind the consent mechanism described in Section 4 before it can run.

6. Contact

Questions about this policy or the site's use of local storage: contact giladox10@gmail.com. See also the Privacy Policy for how the site handles data more broadly.