Browser storage
Draft version 19 October 2026
What is stored on your device?
The app uses browser storage to keep you signed in, save sample workflows and help recover edits. These records can include personal information and complete workflow or SOP text.
Scroll across the table to read every column.
| Record | Purpose | Duration |
|---|---|---|
Supabase authentication storage, normally under a project-specific sb-…-auth-token key | Signed-in session and token refresh. Temporary PKCE records support the sign-in return. | Session records persist according to the authentication service and browser settings until sign-out, invalidation or clearing. Temporary sign-in records are handled by the authentication library. |
mappedsteps.workspace.USER_ID.WORKSPACE_ID | Copies of account workflows, procedures, revisions and pending edits for this browser. | No automatic expiry. Account sign-out currently leaves these workflow copies on the device. |
flowline.workspace.v1 | The sample workspace and device-only workflows. The older internal key is retained so saved work can reopen. | No automatic expiry; stays until this site's browser data is cleared. |
mappedsteps.imported.USER_ID.WORKSPACE_ID | Remembers an explicit import of device workflows into an account. | No automatic expiry. |
mappedsteps.activeWorkspace.USER_ID | Remembers the workspace last selected for this account. | No automatic expiry; cleared with this site’s browser data. |
Session storage: mappedsteps.pendingWorkspaceInvite | Preserves an invitation token during sign-in. The link is removed from the address bar after reading. | Removed when accepted or dismissed, or when the browser ends the page session. It is not encrypted by the app. |
Older account-only cache and import keys may remain from previous versions. They are read only when reopening the original personal workspace; they are not imported into an unrelated shared workspace. View-only sessions do not create a new workflow cache.
Shared devices
Browser workflow copies are not encrypted by this app. Separating them by account and workspace identifiers does not prevent someone with access to the browser profile or developer tools from reading them. Sign-out ends the session but does not currently erase workflow copies. Avoid shared browsers for confidential information.
To remove device copies, first wait for a successful account save or download an editable JSON backup. Then sign out and clear site data for Mapped Steps in your browser settings. Clearing site data can remove unsynced work. It does not delete documents already stored in your account.
Cookies, fonts and other services
No advertising tags or optional analytics are implemented in this release. Fonts are served from the app's own origin. Authentication, hosting and abuse-prevention providers may process network or device information when their features run. Cloudflare Turnstile is used on public email-export and AI-generation forms when configured. Microsoft, Google or Apple receives information when you choose that sign-in provider.
These storage features support the requested editor and account service. If optional tracking is added, the notice and any required choice will be provided before activation. Blocking browser storage may prevent sign-in persistence or device saving; editable file exports remain available.
Links and exported copies
Workspace invitation, contribution and unsubscribe links contain values in the part after #. Workspace invitations require sign-in with the invited verified email and are accepted once. Anyone holding a contribution link can see its workflow title and request brief and submit steps while it is active. The contribution token is also sent to the account service to validate the request. An unsubscribe value is signed, not encrypted, and includes an encoded email address. Do not publish these links.
Downloads, email attachments and copies recipients keep are outside the browser cache. Removing an account or clearing this site cannot recall those copies.
For access or deletion requests, use the operator contact once it is supplied in the privacy notice. That contact has not yet been supplied for this preview.