Optional analytics stays off by default

    Cookie Policy

    This page explains Jam & Joy's necessary browser storage, embedded services, optional Analytics, and how to change your choice.

    Effective and last updated: September 3, 2026

    What cookies and browser storage are

    Cookies are small files a site or service can store in your browser. Local storage is a similar browser feature used to remember settings. Some technologies support a requested function; others measure how a site is used.

    Necessary preference storage

    Always active

    We store jam_joy_cookie_consent in local storage. It remembers your analytics choice, policy version, time of change, and a random consent identifier until you clear browser storage or a material policy update requires a new choice.

    A matching pseudonymous event is stored in Supabase for accountability. It does not intentionally contain your name, email, form answers, or raw IP address and is deleted after 24 months.

    Curate catering form

    Requested functionality

    The home page embeds a request form from Curate. Loading and using it connects your browser to Curate, which may process technical information and use technologies needed to display, secure, and operate the form. Curate's own privacy practices apply to the embedded form.

    Google Maps

    Embedded content

    The contact section includes an embedded Google Map that loads when the map reaches the visible page area. Google may receive device, browser, network, and interaction information under its own privacy practices. This is separate from our optional Google Analytics setting.

    Google Analytics

    Optional — off by default

    If you accept, Google Analytics 4 may set first-party analytics cookies and measure visits and interactions so we can improve the site. Advertising storage, ad user data, and ad personalization remain denied.

    If you reject or later withdraw consent, measurement is disabled and the site attempts to remove Google Analytics cookies created on this domain.

    Hosting, security, and audit protection

    Operational processing

    Lovable and supporting infrastructure may process limited request data and operational telemetry to deliver, secure, diagnose, and measure the hosted service. The consent endpoint uses origin checks and one-way, short-lived rate-limit tokens to deter automated abuse. Network tokens rotate daily and rate-limit rows are removed after two days; raw network addresses are not stored in the audit tables.

    Manage your choice

    Change your Analytics preference at any time. You can also clear browser cookies and local storage; the panel will appear again on your next visit.

    Questions

    Email hello@jamandjoy.com or read our Privacy Policy.