Cookie Policy
Everything this site stores in your browser, what each item is for, and how to turn off the parts that are optional.
The Short Version
We use a small number of cookies to sign you in and keep the site secure, a few browser-storage entries to remember your preferences on this device, and first-party analytics to see which listings and pages get used.
We do not use advertising cookies, and we do not let advertising networks track you across other sites from here.
This page is a companion to our Privacy Policy, which explains what happens to the information once it reaches us.
Essential Cookies
Set by our authentication layer. Without these you cannot sign in, and the site cannot tell one signed-in person from another. They are not used for analytics or advertising, and they cannot be switched off while you use an account.
| Cookie | What it does | Lifetime |
|---|---|---|
| next-auth.session-tokennamed __Secure-next-auth.session-token in production | Keeps you signed in. Holds a signed token identifying your account and role. HTTP-only, so page scripts cannot read it. | Until you sign out, or 30 days |
| next-auth.csrf-tokennamed __Secure-next-auth.csrf-token in production | Protects sign-in and sign-out from cross-site request forgery — stops another site from submitting those forms as you. | Session |
| next-auth.callback-urlnamed __Secure-next-auth.callback-url in production | Remembers the page to return you to after signing in. | Session |
| next-auth.pkce.code_verifierGoogle sign-in only | One half of the PKCE proof that secures the Google OAuth exchange, so the sign-in cannot be intercepted. | 15 minutes |
| next-auth.stateGoogle sign-in only | Ties the response coming back from Google to the sign-in you actually started. | 15 minutes |
| next-auth.nonceGoogle sign-in only | Guards against replay of the identity token Google returns. | Session |
All of these are HTTP-only and restricted to this site, and are marked Secure when the site is served over HTTPS.
Analytics Identifiers
Optional. This is the part the banner controls.
Our analytics is first-party: events go to our own servers, not to an advertising network. Notably, it does not set a cookie of its own. Instead each event carries:
- • A session identifier — a random string generated fresh in memory each time a page loads. It is not written to a cookie or to storage and does not survive a reload, so it groups actions within one visit and cannot be used to recognise you later.
- • Your user ID, when you are signed in — taken from your session cookie, so analytics events made while signed in are linked to your account.
- • Device and browser details — device type, browser name and version, operating system, screen and viewport size.
- • Page and referrer — the URL and title of the page, and where you came from, including any utm_ campaign parameters on the link.
- • Your IP address — recorded by our server when it receives the event.
Events are batched in the browser and sent every few seconds rather than one at a time.
Browser Storage
These are stored in your browser's local storage rather than in cookies, which means they stay on your device and are never transmitted to us automatically.
- br-cookie-consentYour choice on the cookie banner: "accepted" or "essential". Keeps the banner dismissed.
- babcock-directory-recent-searchesYour recent directory searches, so the search box can suggest them again.
- favoritesBusinesses you have favourited on this device.
- babcock_selected_businessFor owners of more than one listing: which business your dashboard was last showing.
- pwa-installed / pwa-install-dismissedWhether you installed our app to your home screen, or dismissed the prompt, so we stop asking.
We also register a service worker that caches pages and images so the site loads quickly and works with a poor connection. The cache holds copies of pages you have visited; it contains no identifiers and is cleared with your site data.
Your Controls
The banner
On your first visit you are asked to choose. Picking Essential only means our analytics never starts: no page views, no listing interactions, nothing is sent. Picking Accept allows it. Until you choose, analytics runs as described above.
Changing your mind
Your choice is saved under br-cookie-consent in this browser's local storage. Clearing site data for babcockranchdirectory.com removes it and the banner returns, letting you choose again. Because the choice is per-browser, you will be asked again on other devices.
Browser settings
Every major browser lets you view, block and delete cookies and site data, and offers a "Do Not Track" or tracking-protection setting. Blocking our essential cookies will stop you from being able to sign in.
Ask us to delete your data
You can ask us to delete analytics events linked to your account — see Access, Correction and Deletion Requests.
Third-Party Content
Some pages embed or load content from other companies, and those companies may set their own cookies when that content loads:
- • Google — sign-in, maps and Places content on listings.
- • Stripe — the checkout used for paid placements, which sets cookies needed for payment security and fraud prevention.
- • Cloudinary and Sanity — hosting for listing images.
These are governed by those companies' own cookie and privacy policies. We do not control what they set.
Changes to This Policy
When we add or remove something the site stores in your browser, we update this page and the "Last Updated" date above. Questions? Email brdirectory@cruxnyc.com.