Cookie notice

Strictly necessary

• movebox_session — HTTP-only JWT session, 30 days, Secure on HTTPS, SameSite=Lax. Required to use the signed-in app.

On-device (not cookies)

• movebox_theme, movebox_account_id, movebox_move_id in localStorage.
• IndexedDB database movebox — offline packing queue (may include photos and voice until sync).
• PWA cache via Workbox for the app shell.

Analytics and errors

If Vercel Analytics or Plausible is enabled, it is cookieless (no advertising identifier). If Sentry is enabled, it receives technical error reports with PII scrubbing; it is used to keep the product working, not to advertise.

Consent

Because we do not set marketing cookies, we show a notice rather than a blocking consent wall. You can refuse analytics by using a browser with tracking protection; the session cookie is required to sign in.