Optional analytics stays off by default
Cookie Policy
This page explains Jam & Joy's necessary browser storage, embedded services, optional Analytics, and how to change your choice.
Effective and last updated: September 3, 2026
What cookies and browser storage are
Cookies are small files a site or service can store in your browser. Local storage is a similar browser feature used to remember settings. Some technologies support a requested function; others measure how a site is used.
Necessary preference storage
Always activeWe store jam_joy_cookie_consent in local storage. It remembers your analytics choice, policy version, time of change, and a random consent identifier until you clear browser storage or a material policy update requires a new choice.
A matching pseudonymous event is stored in Supabase for accountability. It does not intentionally contain your name, email, form answers, or raw IP address and is deleted after 24 months.
Curate catering form
Requested functionalityThe home page embeds a request form from Curate. Loading and using it connects your browser to Curate, which may process technical information and use technologies needed to display, secure, and operate the form. Curate's own privacy practices apply to the embedded form.
Google Maps
Embedded contentThe contact section includes an embedded Google Map that loads when the map reaches the visible page area. Google may receive device, browser, network, and interaction information under its own privacy practices. This is separate from our optional Google Analytics setting.
Google Analytics
Optional — off by defaultIf you accept, Google Analytics 4 may set first-party analytics cookies and measure visits and interactions so we can improve the site. Advertising storage, ad user data, and ad personalization remain denied.
If you reject or later withdraw consent, measurement is disabled and the site attempts to remove Google Analytics cookies created on this domain.
Hosting, security, and audit protection
Operational processingLovable and supporting infrastructure may process limited request data and operational telemetry to deliver, secure, diagnose, and measure the hosted service. The consent endpoint uses origin checks and one-way, short-lived rate-limit tokens to deter automated abuse. Network tokens rotate daily and rate-limit rows are removed after two days; raw network addresses are not stored in the audit tables.
Manage your choice
Change your Analytics preference at any time. You can also clear browser cookies and local storage; the panel will appear again on your next visit.
Questions
Email hello@jamandjoy.com or read our Privacy Policy.