Technical Transparency & Storage

Cookie & Local Storage Policy

Last Revised: May 07, 2026 • Statutory Disclosure

Hallway Technologies Pvt. Ltd. ("Hallway," "we," "us") utilizes client-side storage technologies, strictly necessary cookies, and browser local storage to deliver authenticated peer-to-peer services. This document provides complete technical transparency regarding the data tokens stored on your device.

ADVERTISING EXCLUSION STATEMENT: Hallway does not deploy tracking cookies, advertising beacons, canvas fingerprinting, or third-party marketing pixels (such as Google DoubleClick or Meta Pixel). We do not commercialize or share client storage data with advertising aggregators.

TABLE OF CONTENTS

1. TECHNICAL DEFINITION OF CLIENT STORAGE
2. OPERATIONAL NECESSITY & PURPOSES
3. INVENTORY OF STORAGE IDENTIFIERS
4. LOCALSTORAGE VS. COOKIES ARCHITECTURE
5. INFRASTRUCTURE INTEGRATIONS & THIRD PARTIES
6. CLIENT DISABLING & TOKEN REVOCATION
7. TECHNICAL PRIVACY DESK

1. TECHNICAL DEFINITION OF CLIENT STORAGE

Cookies: Small alphanumeric text strings transmitted by web servers to your client browser, stored locally and returned to the origin server with subsequent HTTP requests.

Web Storage (localStorage & sessionStorage): HTML5 web storage specifications enabling client web applications to securely persist key-value pairs without transmitting overhead on every HTTP header.

2. OPERATIONAL NECESSITY & PURPOSES

Storage tokens on Hallway serve strictly three technical functions:

Session Authentication (Strictly Necessary): Storing encrypted JWT authentication claims to keep your verified student session active without prompting repeated magic link dispatches;
State Routing: Preserving onboarding state between profile setup (/setup) and the matchmaking lobby (/match);
Signaling Integrity: Managing WebSocket connection session IDs for WebRTC peer signaling.

3. INVENTORY OF STORAGE IDENTIFIERS

Key / Identifier	Classification	Technical Function	Storage Lifespan
`sb-*-auth-token`	Strictly Necessary	Cryptographic Supabase JWT verifying active collegiate authentication.	Persistent (LocalStorage)
`hallway_setup_state`	Functional	Caches handle, college tag, and branch to avoid form data loss.	Session (LocalStorage)
`_vercel_jwt`	Performance	Edge routing cache validation and DNS load balancing.	Session

4. LOCALSTORAGE VS. COOKIES ARCHITECTURE

Hallway prioritizes localStorage over traditional third-party cookies to reduce vulnerability to Cross-Site Request Forgery (CSRF). Session tokens remain scoped solely to the https://hallwaychat.online origin and cannot be accessed across different domains.

5. INFRASTRUCTURE INTEGRATIONS & THIRD PARTIES

We work exclusively with enterprise infrastructure providers bound by rigorous data protection standards:

Supabase Inc.: For user authentication tokens and PostgreSQL RLS session keys;
Vercel Inc.: For edge reverse proxying and aggregated anonymized load speed telemetry.

6. CLIENT DISABLING & TOKEN REVOCATION

You retain complete technical authority to inspect, purge, or block storage keys via your browser settings:

To clear tokens manually: Open Developer Tools (F12 or Ctrl+Shift+I) → Application → Local Storage → select hallwaychat.online → click Clear All;
Browser settings: Adjust cookie blocking preferences under Privacy & Security in Chrome, Safari, Firefox, or Edge.

Note: Purging essential authentication tokens terminates your active student session and necessitates re-verification.

7. TECHNICAL PRIVACY DESK

For technical inquiries regarding our client-side storage architecture or data minimization:
Privacy Officer: privacy@hallwaychat.online
Corporate Inquiries: hello@hallwaychat.online