Cookies & sessions

Last updated: 20 July 2026 · Version: 1.0

This page explains how TempahHQ uses cookies and similar storage. It complements the Privacy Policy.

1. What we use today

Essential (required for the product)

Name / storage	Type	Purpose
`thq_session`	httpOnly cookie	Keeps shop owners/staff signed in to `/app`. Not readable by page JavaScript.
OAuth state / PKCE cookie (when SSO is enabled)	httpOnly cookie	Secures Auth0 (or similar) login handoff. Short-lived.
`sessionStorage.thq_user`	Browser session storage	Caches a non-secret profile snapshot for the admin UI (not the session secret). Cleared when the tab session ends.

These are strictly necessary to authenticate and operate the admin app. Without them, sign-in does not work.

Public booking

Browsing /book/{slug} and completing a booking does not require a long-lived marketing cookie. Booking data is submitted to our API as part of the form flow.

Development only

In local/mock environments, bearer tokens may be returned for scripts. Production admin auth relies on the httpOnly session cookie.

2. Analytics and marketing cookies

We do not currently set third-party advertising cookies as part of the core product.

If we add privacy-friendly analytics (e.g. first-party or cookieless analytics) later, we will update this page and, where required, request consent before non-essential cookies.

3. How long they last

Session cookie: until expiry set by the server, or when you sign out (server session deleted).
OAuth state cookie: minutes-scale during login only.
sessionStorage profile: until the browser tab/window session ends.

4. Controlling cookies

Most browsers let you block or delete cookies. If you block essential cookies, you may not be able to sign in to the admin app.

You can sign out from the product to end the server session associated with thq_session.

5. Contact

Questions: hello@tempahhq.com