Cookie policy

Cookies are small pieces of data a site can store in your browser and receive on later requests. Local storage and session storage are separate browser features that can keep information between page visits or within a tab.

The public website does not set advertising, analytics or preference cookies, and visitors do not need an account to enquire or download the free prompt pack. There are no analytics trackers or advertising pixels. Fonts are served with the website; gallery media may be delivered from the website or Cloudinary. Instagram is an external link, not an embedded feed.

The enquiry form, work filters and gallery selection use temporary page memory. Submitted enquiries can be stored on the studio’s server-side database, as described in the privacy policy. The code does not save enquiry drafts to cookies, local storage or session storage. Downloading the free prompt pack requires no signup or tracking cookie.

The colour theme control offers System, Light and Dark. System follows your device appearance. Choosing an option saves only that setting in your browser’s local storage under hemframe-theme, so it can apply across public pages, the studio admin and client workspace. It is not sent with requests or used for tracking.

You can change the setting at any time or clear it in your browser’s site-storage settings. It remains until changed or cleared. If local storage is blocked, the selected theme works for the current page without being remembered after a reload.

The restricted studio content desk uses Supabase authentication. When an authorised staff member signs in, the website stores the authentication session in HTTP-only, same-site cookies. Production HTTPS sessions use secure cookies. These cookies maintain staff access and session renewal; they are not advertising or visitor-tracking cookies.

Signing out clears the staff authentication session. Blocking these cookies prevents staff sign-in, while the public enquiry form and free resource remain available without an account. Session duration also depends on the studio’s Supabase authentication settings.

Opening a valid private project invitation sets the HTTP-only, same-site cookie hemframe_client_session. On the production HTTPS site it is marked secure. It authorises access to one project for up to seven days, subject to earlier studio revocation, project closure or sign-out. It is not used for advertising or cross-site tracking.

The invitation secret is supplied in the link fragment, removed from the address bar when the workspace opens, and exchanged only when you choose to open the project. Server records store hashes of invitation and session secrets. Briefs use page memory while you edit and server-side draft storage when you save; the workspace does not save draft copy or invitation secrets to local storage.

Hosting and network services may process technical requests and security logs independently of cookies. A hosting or security provider may also add its own necessary cookies depending on the deployed setup.

No hosting-provider cookie inventory is confirmed here. If the deployed site introduces additional storage or services, this policy must describe their purpose and any relevant choices before they are used.

Following an Instagram or file-sharing link opens that service. Opening an email draft uses your email app or provider. Those services may use cookies and other storage under their own policies; their behaviour is separate from this website. Loading a Cloudinary-hosted gallery file also sends that provider the technical request needed to deliver the media.

If automated enquiry delivery is enabled, it is handled by a server-side service. That is processing of enquiry information, explained in the privacy policy, rather than an embedded advertising tracker.

You can inspect, block or clear cookies and site storage in your browser settings. Settings vary by browser. Clearing site data will not remove an email you have already sent or records held by a service provider.

The current site has no optional tracking cookies to accept or reject, so it does not display a cookie-consent banner. If optional tracking is added, the policy and any required consent controls must be updated first.

Contact the studio if you have a question about storage or notice behaviour that differs from this description. The date above records the most recent policy update. Personal-information requests are covered by the privacy policy.