Cookies and Storage

Cookie and tracking notice

1. No tracking. Browsing bidbossinc.ca places no cookies and no identifiers on your device, and our analytics are cookieless: pages are measured in aggregate, and nothing profiles you or follows you across sites. Sections 2, 4 and 5 list everything the site stores, everything it loads, and what it does not.

2. What the site stores on your device. Two preference flags and one cached page, none of them an identifier:

   What	Where	What sets it	How long	What it is for
   bb.subscribe.snooze	your browser's local storage	closing the email-signup prompt	30 days	keeps the prompt closed
   bb.subscribe.done	your browser's session storage, this tab only	subscribing, or sending any form on the site	until you close the tab	stops the prompt reappearing in the same visit
   one offline page	your browser's cache storage	the site, on your first visit	until you clear site data	a page still loads if your connection drops

   Neither flag contains an identifier, a visit count, or anything about what you read. Two browsers that closed the prompt in the same minute hold values that cannot be told apart. All three can be cleared like any site data in your browser.

3. Signing in. When you sign in to your account, strictly necessary storage runs your session and keeps you signed in. It exists so the account works, carries no advertising or cross-site tracking, and clears when you sign out.

4. Outside addresses these pages contact. Three, and no others:

   Address	What it is	What it sets	Whose policy governs it
   hibid.com	the live auction catalogue, shown in a frame on our pages	inside that frame, on hibid.com's own domain: __cf_bm, a Cloudflare bot-management cookie lasting about 30 minutes, which tells people from bots. We cannot read it and we do not use it.	HiBid's and Cloudflare's
   va.vercel-scripts.com	the Vercel Web Analytics script	nothing on your device	Vercel's, and ours
   vitals.vercel-insights.com	where that script sends its counts	nothing on your device. No cookie, no identifier, no profile.	Vercel's, and ours

   Two more are permitted and are not used here. One security policy covers the whole site, including the signed-in parts, and it also allows our database host (*.supabase.co) and our payment provider (secure.helcim.app and api.helcim.com). Neither is contacted from a public page: nothing on these pages references either. They are named because you can read the policy, and a notice that lists three where the policy lists five is a notice that looks like it is hiding two.

5. What the site does not load. No advertising network, no social plugin, no session recorder, no heat map, no chat widget from a vendor, and no web fonts from a third party: our fonts are served from our own domain. Customer reviews on the site are a fixed copy of the words, not a live widget, so reading them makes no request to anyone else.

6. Your choices. The sign-in storage cannot be switched off without breaking sign-in. You control the rest: your browser can block or clear cookies and site data, including the hibid.com cookie and the two preference flags. Marketing consent is governed by our communications and consent statement, never by cookies.

7. How this notice is kept true. It is written from the code, not from memory: every write to browser storage on a public page is in one file, and every outside address the browser is permitted to reach is listed in the site's content security policy. Section 4 separates the two things that policy tells you, because they are different: which addresses these pages actually contact, and which the policy permits anywhere on the site. We re-read both whenever an embed or a tool changes. If we ever adopt tracking that requires consent, a consent banner will be added before it runs, and this notice will be updated first.