Cookie Policy · last updated May 9, 2026
What we store on your device.
This page lists every cookie and storage technology used on the site, what it does, how long it lasts, and whether it is active in v1 or planned. Strictly-necessary cookies are required for the site to function. Functional, analytics, and marketing categories require explicit opt-in via the cookie banner once it ships in Phase 7.
Strictly necessary
Required for authentication, security, and basic site functionality. Cannot be disabled — without these, you cannot sign in or check out. No consent is required under EU/UK law for this category.
| Name | Purpose | Storage | Retention | Status |
|---|---|---|---|---|
| sb-* (Supabase auth) | Keeps you signed in across pages and protects against session theft | HTTP-only cookie | Session + refresh window (≤ 7 days) | Active |
| lm-cart | Persists your shopping cart (beat IDs, license tiers) across reloads | localStorage in your browser (not a cookie; stays on your device) | Until you clear it or empty the cart | Active |
| csrf-token | Cross-site request forgery protection on form submissions | HTTP-only cookie | Session | Active |
Functional
Remember your preferences (e.g. cookie-banner choices, theme). Activated once the consent banner ships and you opt in.
| Name | Purpose | Storage | Retention | Status |
|---|---|---|---|---|
| lm_consent | Remembers your cookie-banner choices across visits | First-party cookie | 12 months | Planned |
Analytics
Aggregate traffic measurement. We are evaluating cookieless options (Plausible, Vercel Analytics) so this category may end up not setting any cookie at all. Either way, it activates only after the consent banner is in place and you opt in.
| Name | Purpose | Storage | Retention | Status |
|---|---|---|---|---|
| Vercel Analytics or Plausible | Aggregate, privacy-friendly traffic measurement. We are evaluating Plausible (no cookies, no personal data) and Vercel Analytics (no cookies; first-party only). No third-party tracking. | First-party only — likely cookieless | N/A or short rolling window depending on provider | Planned |
Marketing
None active in v1. If we introduce marketing pixels later, they load only after explicit opt-in. We will update this Policy and notify registered users by email before activation.
| Name | Purpose | Storage | Retention | Status |
|---|---|---|---|---|
| Marketing pixels (Meta, Google Ads, etc.) | Ad attribution and remarketing. None active in v1. If introduced, they will load only after explicit opt-in via the cookie banner. | Third-party cookie + browser storage | Set by provider | Planned |
How to control cookies in your browser
You can clear, block, or restrict cookies at any time through your browser settings. Most browsers expose this under Settings → Privacy. Blocking strictly-necessary cookies will break sign-in and checkout. Blocking optional categories has no impact on the site experience in v1 because we currently do not set them.
When the consent banner ships, you will be able to change your preferences anytime by opening the cookie controls from the footer. Until then, the only state stored on your device is the strictly-necessary set above.