Release candidate 0.5 — 26 October 2026. The live provider-storage inventory remains an activation check; no optional tracking consent is bundled with this notice.
Operator: Jacobus Venter, 12 Goudrif Avenue, Allen Grove, Kempton Park, 1619, Gauteng, South Africa. Contact: prismage.visuals@gmail.com.
The application reads Clerk's __session cookie to authenticate signed-in requests. Authentication SDKs and provider security features may use additional cookies or browser storage; their exact names, domains, expiry and purposes depend on deployed settings. Inventory these without recording token values. Public appointment pages bypass the Clerk sign-in provider and use Cloudflare Turnstile verification.
The unused sidebar_state preference-cookie write has been removed from application source. An older cookie may remain in a browser until it expires or is cleared. Do not describe it as an active requirement of the current interface.
No direct advertising or analytics tracker was found in the reviewed application source. This is not a completed live-provider audit and does not establish every hosting/authentication feature. Do not copy the visual-production website's analytics or cookie banner choices into this service unless those technologies are actually used here.
Necessary storage may support requested sign-in and security functions. Optional tracking, if introduced, requires appropriate choices before use where applicable, with an accessible rejection/withdrawal mechanism. No optional-cookie banner is claimed to exist today. Browser controls can remove cookies but may sign a user out. The notice must name actual controls and technologies after the live audit, not present a generic consent button as a compliance guarantee.
Inventory still to complete: technology/name, provider and domain, purpose, expiry or retention criterion, necessity, applicable choice/control and last verification date. Do not place passwords, session tokens or their values in that inventory.
Optional IndexedDB job-card drafts
After a technician enables local drafts, field-service-device-drafts-v1 stores account/company/profile scope, an enable preference, draft job identifier/number, work-note fields, original-record digest, retry identifier and update time. No authentication secrets are stored there. Local data persists until synced or cleared, including current-scope cleanup through field-view sign-out; changing profile or losing server access does not remotely erase old device copies. Browser storage controls may remove all local drafts, including unsent work. This is user-requested device functionality, not advertising tracking or blanket consent.
Observed browser cookies — 26 October 2026
A signed-in browser check identified the following cookie families. Instance-specific suffixes may appear alongside the base name.
| Cookie name or family | Observed domain | Function and expiry observation |
|---|---|---|
| __session and instance-suffixed variants | desk.prismage-visuals.com | Clerk sign-in session credential. This browser displayed an expiry in October 2027; cookie expiry does not guarantee that a login remains valid until then. |
| __client_uat and instance-suffixed variants | .prismage-visuals.com | Clerk client/session freshness information. This browser displayed an expiry in November 2027. |
| __client | .clerk.prismage-visuals.com | Clerk browser/client authentication state. This browser displayed an expiry in November 2027. |
| clerk_active_context | desk.prismage-visuals.com | Clerk active authentication context. Browser displayed Session. |
| __cf_bm | .clerk.prismage-visuals.com | Cloudflare bot-management security cookie for the authentication endpoint. Time-limited expiry was displayed. |
| _cfuvid | .clerk.prismage-visuals.com | Cloudflare rate-limiting security identifier. Browser displayed Session. |
These are observations from one signed-in test, not fixed retention promises. Provider settings, browser behavior and later visits can change expiry. Session describes the browser's cookie classification; browser session restoration can affect how long it remains. Server-side account and log retention are separate.
The normal browser profile also contained _ga and a _ga_ identifier on .prismage-visuals.com. Neither appeared during the fresh private-window check that visited this service directly and signed in. Existing parent-domain cookies may be available to subdomains. These tests do not establish where those cookies originated or exclude tracking that does not use cookies. No cookie values were collected for this review.
Provider references: https://clerk.com/docs/guides/how-clerk-works/cookies and https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/
The remaining review covers signed-out and public appointment flows, actual provider configuration and applicable choices. This review copy does not claim a complete cookie audit or activate optional tracking.