Legal

Cookie Policy

Last updated: 26 October 2026

Short version: this site sets no tracking cookies. Our analytics is cookieless by design — no consent banner is needed because nothing non-essential is stored on your device.

1. What this site sets

ItemTypePurposeDuration
Umami analytics none Cookieless by design — identifies sessions with a rotating salted hash, never a cookie, never your IP in clear form, never across sites. —
Session replay & heatmap none Records interactions on this site (mouse movement, clicks, scrolling, page structure) for UX analysis — the same thing Hotjar/Clarity-style tools do. Input fields are masked; typed text is not captured. No cookies are used; temporary recording buffers may live in browser storage and are discarded. Disabled automatically for visitors sending Do-Not-Track or Global Privacy Control signals. Replays kept 30 days server-side

2. Other parts of M8Studio

  • Web app (/app/) — stores your login session token in browser storage (localStorage) so you stay signed in. Strictly necessary for the app to work — the legal equivalent of an essential cookie.
  • CMS admin (/admin/) — stores the editor's login session in localStorage for the same essential reason. Site editors only; regular visitors never touch it.
  • Desktop apps — M8Artist and the M8Studio plugin are native apps; they don't use browser cookies at all.

3. What this site does not set

  • No advertising or marketing cookies — there are no ads.
  • No third-party tracking cookies — nothing from Google, Meta, or any network.
  • No cross-site identifiers of any kind.

4. Why there's no annoying consent wall

Under the ePrivacy rules that apply across the EU/UK (and equivalents elsewhere), a consent banner is only required for non-essential storage and tracking. Our essential storage (login sessions) is exempt, and our cookieless, self-hosted analytics qualifies as privacy-respecting audience measurement — the category regulators exempt from consent requirements. Session recording is disclosed here rather than hidden behind a banner.

5. Opting out of session recording

Session replay and heatmaps are automatically disabled when your browser sends a Do-Not-Track or Global Privacy Control signal — enable either in your browser settings (supported in Firefox, Brave, Safari via extensions, and most privacy browsers). Cookieless analytics still runs, since it identifies no one.

6. Blocking cookies generally

Every browser lets you block or delete cookies and site data (Chrome, Firefox, Safari and Edge all have per-site controls). Blocking cookies here changes nothing — we don't set any. Clearing site storage signs you out of the web app.

More detail on data handling: Privacy Policy · info@m8studio.co.uk