Cookie Policy
Xanivar Field · Last updated 11 October 2026
This policy explains how Xanivar Labs Pte. Ltd. uses cookies and similar technologies in Xanivar Field, the Field website at field.xanivar.com, the Field web app, and the Field mobile apps. It covers Field only; our other products have their own policies. Read it with the Field Privacy Policy.
What counts as a cookie here
Cookies are small files a site stores in your browser. Field also uses local storage, a service worker and Cache Storage, IndexedDB, and the equivalent secure storage in the mobile apps. We call all of it device storage, and everything below about consent applies to all of it, not only to cookies.
Advertising tracking
We do not use advertising tracking on our websites.
Strictly necessary, always on
These deliver the service you asked for: signing you in, keeping your session secure, blocking automated abuse, remembering the choice you make about cookies, and holding your work on the device while you are offline. We do not ask for consent for these, because Field cannot work without them. You can block them in your browser, but offline clock-in, offline visit records and queued media uploads will stop working.
| Name or technology | Set by | Type | Purpose | How long |
|---|---|---|---|---|
| sb-<project>-auth-token | Xanivar (Supabase Auth) | Cookie | Signs you in and keeps your session valid | Session, until sign-out or expiry |
| Supabase auth refresh and verifier values | Xanivar (Supabase Auth) | Cookie / local storage | Renews your session securely without asking you to sign in repeatedly | Until sign-out or expiry |
| __cf_bm, cf_clearance | Cloudflare | Cookie | Bot management and security; blocks automated abuse | Up to 30 minutes (__cf_bm); up to 30 days (cf_clearance) |
| Cloudflare Turnstile challenge values | Cloudflare | Cookie / local storage | Confirms a human is signing up or signing in, without a tracking-based CAPTCHA | Short-lived, per challenge |
| xnf_cookie_consent | Xanivar | Local storage | Records the choice you made here, so we do not ask again and optional storage stays off if you declined | Until you change it; we ask again after 12 months |
| Service worker, Cache Storage, IndexedDB (offline store) | Xanivar | Device storage | Lets Field run offline: caches the app and holds clock-ins, visit records, notes and media captured with no signal until they can sync | Until synced, or until you sign out or clear app data |
| Web push subscription (VAPID) | Xanivar (self-hosted) | Push registration | Delivers job, shift and message notifications, if you turned notifications on | Until you turn notifications off or uninstall |
Optional, only if you accept
We use our own first-party analytics to see how Field is used so we can improve it. The data goes to our own servers; there is no analytics vendor using it for their own purposes. We ask before any of it is stored on or read from your device. Nothing here runs unless you accept, and if you decline, or later turn it off, we delete what was stored.
| Name or technology | Set by | Type | Purpose | How long |
|---|---|---|---|---|
| analytics_session_id | Xanivar | Local storage | Groups activity into a single visit | Until cleared |
| xn_anon_id | Xanivar | Local storage | A random identifier that lets us count returning usage without knowing who you are | Until cleared |
| analytics_user_id | Xanivar | Local storage | Links product analytics to your Field account once you are signed in | Until sign-out or cleared |
| analytics_queue | Xanivar | Local storage | Holds analytics events briefly so they are not lost on a poor connection | Until sent, then deleted |
Analytics events record the page path and title, the referring page, any campaign parameters in the link you followed, timing measurements, your session and account identifiers, and your browser user-agent string.
Error and security logging
We keep server-side security and error logs, such as failed sign-in attempts and application errors, as part of running and securing Field. Those live on our servers rather than on your device, so they are not part of the choice above. They are covered by the Privacy Policy.
Your choice, and changing it
We show a banner before anything optional runs, with Accept and Reject offered equally. Change your mind at any time in Settings → Privacy, or by clearing this site’s data in your browser, which makes the banner appear again. Withdrawing consent stops future collection; it does not undo processing that already happened lawfully. We ask again after 12 months, or sooner if what we use materially changes.
This choice is separate from accepting the Field terms. Accepting the terms is not consent to analytics, and declining analytics does not affect your access to Field.
Global Privacy Control
If your browser sends a Global Privacy Control signal, we treat it as a refusal of optional storage and apply it automatically, without asking you again. There is no common standard for Do Not Track, so we do not respond to DNT headers, use the banner, your settings, or GPC instead.
Where you are
In the EU and UK, we ask for consent before storing or reading anything not strictly necessary, as the ePrivacy rules and PECR require. In Singapore we handle personal data under the Personal Data Protection Act 2012. In California and other US states, we enable optional product analytics only after consent. We do not share website activity for advertising. Field is available globally, and nothing here removes a right you have under your own local law that cannot be excluded by agreement.
Changes and contact
We update this policy as the product changes, and we will ask for consent again before a material change takes effect. Questions: ops@xanivarlabs.com, Xanivar Labs Pte. Ltd., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914.