Not ready to publish. Company registration details, the physical address and the Information Officer are still unfilled. ECTA § 43(1) requires them, and a policy that names no responsible party is unenforceable and misleading. Fill in src/lib/legal/entity.ts before launch.
Draft pending legal review. These documents were drafted against POPIA, ECTA, the CPA and PAIA, but not by an admitted attorney. Enc0ded processes identity documents and special personal information, where the consequences of a defective notice fall on the data subject. Have them reviewed before they are relied on.
Version 1.0 · Last updated 22 August 2026
Enc0ded sets the smallest number of cookies it can. There is no analytics, no advertising and no third-party tracking, so there is no consent banner — because there is nothing to consent to beyond what the service cannot run without.
| Cookie | Purpose | Lifetime |
|---|---|---|
sb-*-auth-token | Keeps you signed in. Set by Supabase, our authentication provider. Without it every page load would sign you out. | Until you sign out, or one year |
sb-*-auth-token-code-verifier | Holds the PKCE verifier during sign-in, so an intercepted authorisation code cannot be exchanged by anyone else. | Minutes, during sign-in only |
Both are strictly necessary. Blocking them prevents you signing in at all.
No analytics cookies. No advertising or retargeting pixels. No social media embeds. No session recording or heatmaps. No cross-site tracking.
A product that asks you to trust it with your identity documents while embedding a third-party tracker on the page has answered the question about whose interests it serves. So we do not.
POPIA treats a cookie identifier as personal information where it can be linked to you, and consent is needed for processing that is not otherwise justified. Strictly necessary cookies — the ones that keep you signed in — are justified by the contract between us under § 11(1)(b), and asking permission to run the service you have asked us to run is theatre.
If we ever add anything beyond that, we will ask first, properly, with a real choice and a real refusal.
Every browser lets you view and delete cookies. Deleting ours signs you out; nothing else is lost. Blocking them entirely prevents sign-in.
Questions about this notice go to [TO BE COMPLETED].