Cookie Notice
Most sites open with a consent banner because they are loading trackers they cannot justify. We are not, so there is nothing to consent to. Here is precisely what is stored on your device and what is not.
Last updated July 26, 2026
The short version
Browsing umbramodels.com sets no cookies at all. There is no Google Analytics, no advertising pixel, no Meta pixel, no session recorder, and no third-party tag of any kind on the public site. The only cookies we set are the ones that keep you signed in to the private client portal, and you will only ever meet them if we have invited you to it.
The cookies we actually set
These are set only on /portal, only after you sign in, and only by our own domain. They are strictly necessary: without them there is no way to know you are signed in, so the portal cannot work.
| Cookie | What it does | How long it lasts |
|---|---|---|
sb-*-auth-token | Holds your signed session for the client portal, issued by our authentication provider, Supabase. It is what stops your account from being visible to anyone else. | Until the session expires or you sign out |
sb-*-auth-token.0, sb-*-auth-token.1 | The same session token split across several cookies when it is too large for one. Same purpose, same lifetime. | Until the session expires or you sign out |
We set no preference cookies, no analytics cookies, and no marketing cookies. If you ever see one on this domain that is not described here, tell us at team@umbramodels.com and we will investigate it as a bug.
How our analytics works without cookies
We still want to know which articles people read. We do that with a first-party counter that writes nothing to your device. When a page loads, our own server records the page path, the page that referred you, a country code our host derives from the connection, whether the request looked like a bot, and a visitor identifier.
That identifier is a SHA-256 hash of a secret salt, the current date, your IP address, and your browser’s user agent. We never store the IP address itself. Because the date is part of the input and the salt is secret, the identifier changes every day and cannot be reversed, so we can count how many people read a page today without being able to recognise you tomorrow or link you to anything else we hold. These records are deleted automatically after 13 months.
The trade is deliberate. We lose returning-visitor tracking and get a measurement system that holds no personal data.
Why there is no consent banner
Consent for cookies comes from the ePrivacy Directive, which requires consent before storing information on, or reading information from, your device. Two things follow from how this site is built.
First, our analytics stores nothing on your device and reads nothing from it. It is a plain server-side record, so the consent requirement is not engaged, and because the visitor identifier is an irreversible daily hash rather than an identifier for you, the resulting records are not personal data under the GDPR.
Second, the portal sign-in cookies fall within the exemption for storage that is strictly necessary to provide a service you have explicitly requested. Signing in is the service. A banner asking your permission to remember that you signed in would be theatre.
If we ever add a tracker that does require consent, we will ask for it properly before it loads, and this page will say so.
Third parties
Our site is served by Netlify, our data lives with Supabase, our email is sent through Resend, and an application photo, if you choose to upload one, is stored with UploadThing. Those providers process data on our instructions. The only one your browser talks to directly during an ordinary visit is our host, and it sets no tracking cookies for us. Uploading a photo involves a direct request to our upload provider so that the file can be transferred.
We embed no third-party fonts loaded at run time from another company’s servers, no social widgets, and no comment systems. Full detail on providers and retention is in the privacy policy.
Controlling cookies yourself
Every major browser lets you block or delete cookies, usually under privacy or site settings. Blocking cookies for umbramodels.com has no effect on the public site, because it sets none. It will stop you signing in to the client portal, because the sign-in cookie is what keeps you signed in. Clearing cookies signs you out.
Do Not Track and Global Privacy Control
We do not track you across other websites, so a Do Not Track header or a Global Privacy Control signal has nothing here to switch off. We treat a Global Privacy Control signal as a valid opt out of any sale or sharing of personal information, and as stated in our privacy policy, we do not sell or share personal information in the first place.
Questions
Email team@umbramodels.com. If you want the legal detail on what we collect and why, read the privacy policy.