1. Scope and contact
Team Legend Leadership Development (“Team Legend,” “we,” “us,” or “our”) uses cookies and related technologies to provide its private community at teamlegendld.com. This notice explains their purpose, duration and your choices. Our Privacy Policy explains the wider handling of personal information.
Questions or privacy requests: support@teamlegendld.com.
2. What cookies and related technologies do
A cookie is a small value saved by your browser and sent back with requests to the relevant website. Session cookies generally expire when the browser session ends. Persistent cookies remain until their expiry, deletion or earlier removal by the service or browser.
Cookies can contain identifiers or security credentials. They do not need to contain your name to relate to your account. Keep cookie values and session credentials private. “HttpOnly” cookies cannot be read directly by ordinary page scripts, and “Secure” cookies are sent over HTTPS; these measures reduce risks but do not make an account immune to compromise.
Browser storage and server-side account records are different. Profile preferences, reading checkmarks, RSVPs and activity records may be saved in the service database rather than in cookies. Clearing cookies does not delete that information or close your account.
3. Cookies used by the community
The community uses first-party cookies for authentication and temporary security flows. Names can include a project identifier or numbered chunks, depending on the environment and cookie size. The following describes the current implementation; not every cookie is set on every visit.
Authentication cookies. Supabase authentication uses names beginning with sb-, followed by the deployment's project identifier and -auth-token. Large values may be split into cookies ending in .0, .1 and so on. They maintain the signed-in session and allow the server to refresh and validate access. The current library sets a browser lifetime of up to 400 days, which may be renewed during use. This is a cookie-storage limit, not a promise that an account remains authorized for 400 days: access credentials have shorter validity, and sign-out, revocation, account restrictions or security settings can end access earlier. Session authentication cookies are removed on sign-out from the community.
Authentication-flow verification cookies. Email recovery/confirmation flows may also set related cookies with -code-verifier, -flows-code-verifier or a flow-specific -flow- suffix. These support the security check that connects a flow started in a browser with its later callback. They use the same library browser-storage limit of up to 400 days, but may be replaced or removed earlier as a flow completes, fails or is superseded. A stored verifier does not itself grant access or keep an expired email link valid.
Invitation cookie tl_sb_invite. Used after an invitation is checked to associate the registration/acceptance flow with that invitation. Its maximum browser lifetime is 15 minutes and it can be cleared earlier when the flow completes or is reset. The invitation itself has its own expiry and single-use restrictions; this cookie does not extend it.
Recovery cookie tl_password_recovery. Used during an authorized password-reset flow. Its maximum browser lifetime is 15 minutes and it can be cleared earlier when recovery completes or is reset. It is separate from the lifetime of an emailed recovery link or a normal signed-in session.
Restricted preview cookie tl_review_access. Used only on a gated staging/review deployment to remember successful entry through its additional review gate. Its maximum browser lifetime is 7 days. It does not create a member account, replace application sign-in or authorize access to private member data. It is not part of ordinary production membership.
These cookies are set through the community's domain by its server-side authentication or security flows. Supabase and Cloudflare support the underlying service; the technology provider's name does not by itself mean the cookie is an advertising or third-party tracking cookie.
4. Purposes and optional tracking
We use the cookies above to provide requested sign-in, invitation and recovery functions and to protect private access. They are not used to build advertising profiles or track browsing across unrelated websites.
The current community does not use Google Analytics, advertising pixels or optional third-party analytics tags, and has no advertising-cookie preference panel. Operational request/security records are not the same as an advertising tracker. Where applicable law permits strictly necessary storage for a service you request without optional consent, we rely on that distinction only for the necessary purpose. Merely using the community is not blanket consent to unrelated tracking.
If we introduce nonessential technologies, we will update the notice and provide the choices or prior consent required by applicable law before using them for those purposes.
5. External services and emails
Following a Zoom, social-media, book or other external link takes you to a service that can use its own cookies and technologies under its own policy. This notice does not control those external sites or claim that their optional tracking is necessary for our community.
Resend supports transactional email delivery. An email may contain a sign-in, invitation or recovery link; do not forward private links. Email delivery/status records are described by the Privacy Policy and are not automatically cookies stored by our community in your browser.
6. Managing cookies
Use your browser's privacy/site-data settings to inspect, delete or block cookies for the community. Your browser provider's help explains the controls for your device. Blocking necessary cookies can prevent sign-in, invitation acceptance or recovery. Deleting authentication cookies can sign you out, but does not necessarily revoke sessions on other devices. Use the available account/session controls or contact support if you suspect unauthorized access.
Signing out of the community is different from clearing the separate restricted-preview cookie or deleting all browser data. Deleting cookies also does not remove messages already delivered, profile records or service backups. Contact support for an account or data request.
7. Browser privacy signals
Global Privacy Control (“GPC”) signals an opt-out of personal-information sales or sharing for targeted advertising. The community does not currently carry out those activities, so there is no such activity for the signal to turn off. The application does not currently provide a separate GPC-detection or confirmation feature. Necessary authentication and security processing continues; applicable opt-out obligations and privacy rights are not waived by this statement.
Do Not Track (“DNT”) is a different, older browser signal. We do not currently change processing in response to DNT. This does not limit any right under applicable law.
8. Changes
We will revise this notice when relevant practices change and show the updated date. Material changes and any required consent or choices will be communicated as applicable. For questions or help, email support@teamlegendld.com.