PickMySlot1. What this policy covers
Cookies are small files a website can store in a browser. Similar technologies include local storage, session storage, IndexedDB and application caches. This policy covers these technologies on pickmyslot.app and related Firebase sign-in pages, not only traditional cookies.
Installing the progressive web app does not make it a separate data service: its sign-in and device-storage behavior follows the same account and browser rules. The Privacy Policy explains the personal information involved.
Optional Microsoft or Zoom authorization uses a short-lived Secure, HttpOnly, SameSite cookie on the integration callback path to bind the connection attempt to your browser. It expires after ten minutes and is cleared when authorization returns. The Microsoft flow also uses PKCE. It is not an advertising cookie.
2. Current storage inventory
The current release uses the following operational storage. Provider-managed names and exact expiration can vary by browser, SDK and sign-in method; we do not assign a made-up fixed lifetime to them.
| Technology / examples | Purpose | Duration and controls |
|---|---|---|
| Firebase Auth: IndexedDB/local storage, with session storage or cookies used by sign-in helpers | Keep the requested account signed in and coordinate secure Google sign-in redirects/popups. | Local sign-in state can persist until sign-out or site-data removal. Temporary redirect/session records normally last for the sign-in flow or session; provider cookies follow provider/browser settings. |
| App local storage: flutter.cached_user_profile_json, flutter.cached_bookings_json, flutter.cached_meeting_types_json, flutter.user_session_active (web key prefixes may vary) | Restore the signed-in workspace and cache profile, booking and meeting-type information on the device. | Updated as account data changes. App caches are cleared on sign-out; a false session marker may remain. You can clear site data in browser settings. |
| Browser/PWA resource cache and service worker, where supported | Load/cache app code, fonts and icons and support installation/update behavior. | Browser-managed; replaced or removed during updates, storage eviction, service-worker removal or clearing site data. |
| Google sign-in/provider storage on Google or Firebase domains | Authenticate with Google when you choose that method and protect the sign-in flow. | Governed by Google and browser settings. Signing out of PickMySlot does not necessarily sign you out of your Google Account. |
| pms-page-analytics-choice-v1 (local storage) | Remember an explicit allow/decline choice for optional page analytics; no analytics events are sent before consent. | Choice is reused for up to 180 days, or until changed in Privacy choices or site data is cleared. |
| pms-page-analytics-browser-v1 (local storage, only after consent) | Random browser identifier used for estimated visitors. It is not an account identifier. | Identifier is valid for 30 days before replacement. Choosing No thanks removes it. Browser storage may persist until replaced, withdrawn or cleared. |
| pms-page-analytics-visit-v1:{host} (session storage, only after consent) | Random per-host tab visit identifier. Page-view and meeting-selection retries are deduplicated. | Visit is valid for up to 30 minutes or the current UTC day. It is replaced when expired, cleared on withdrawal, or removed when the tab/session storage is closed. |
3. Advertising, analytics and external content
PickMySlot provides optional first-party booking-page analytics when a host enables it and a visitor allows it. Declining leaves booking available. No Google Analytics, Tag Manager, advertising pixels, email-open pixels or third-party advertising analytics are installed by this feature. Hosts receive aggregate statistics rather than anonymous visitors’ names or email addresses. Use Privacy choices on a participating booking page to change the optional analytics choice.
Google sign-in and host-provided external images or meeting links may involve another provider’s storage and policies. Checkout for PickMySlot account plans uses Razorpay Checkout, which may use its own cookies and storage and display provider-controlled payment fields. PickMySlot does not receive full card details or embed live-chat trackers or advertising services. Host service payments are arranged outside PickMySlot.
4. Managing storage and shared devices
Use your browser's privacy/site-data settings to inspect, block or remove cookies and device storage for pickmyslot.app. Sign out first on a shared device. Blocking authentication or redirect storage can prevent Google sign-in, account restoration or other requested features from working.
Clearing browser data or uninstalling the PWA does not delete bookings or your server-side account. Request server-side deletion through support. Private browsing may limit persistence but does not make network requests invisible to the service or its providers.
5. Why no fixed cookie-name list?
The app currently relies mostly on provider-managed authentication storage and its own named local caches rather than a single custom session cookie. SDKs, sign-in providers and browsers can change storage names and behavior. The inventory above describes the actual categories and current app cache keys without promising that every device will contain every item.
You can inspect the browser's site-data tools for the entries on your device. We review this notice when integrations or storage behavior change.
6. Contact and related policies
Contact support@pickmyslot.app with questions about PickMySlot cookies or device storage. Please do not send authentication-token values or screenshots containing private storage contents.