Cookie Notice
Most sites open with a consent banner because they are loading trackers they cannot justify. We are not, so there is nothing to consent to. Here is precisely what is stored on your device and what is not.
Effective July 27, 2026. Last updated July 27, 2026.
Where those two dates differ, this version governs from its effective date, and the version published before it governs until then.
1. The short version
Browsing umbramodels.com sets no cookies at all. There is no Google Analytics, no advertising pixel, no Meta pixel, no session recorder, and no third-party tag of any kind on the public Site. The only cookies we set are the ones that keep you signed in to the private Portal, and you will only ever meet them if we have invited you to it.
This notice is part of the Agreement defined in our terms of service, and words that start with a capital letter here carry the meaning given there.
2. The cookies we actually set
These are set only on /portal, only once you start signing in, and only by our own domain. They are strictly necessary: without them a sign-in cannot be completed and there is no way to know you are signed in, so the Portal cannot work.
| Cookie | What it does | How long it lasts |
|---|---|---|
sb-*-auth-token | Holds your signed session for the Portal. It is issued by our authentication provider and it is what stops your account from being visible to anyone else. | Until the session expires or you sign out |
sb-*-auth-token.0, sb-*-auth-token.1 | The same session token split across several cookies when it is too large for one. Same purpose, same lifetime. | Until the session expires or you sign out |
sb-*-auth-token-code-verifier | A one-time secret written when you ask for a sign-in link, so that the link can only be completed in the browser that requested it. It is what stops an intercepted link from being used by someone else, and it is discarded the moment you are signed in. | Minutes, until the sign-in link is used |
We set no preference cookies, no analytics cookies, and no marketing cookies. If you ever see one on this domain that is not described here, tell us at team@umbramodels.com and we will investigate it as a bug.
3. How our analytics works without cookies
We still want to know which articles people read. We do that with a first-party counter that writes nothing to your device. When a page loads, our own server records the page path, the page that referred you, a country code our host derives from the connection, whether the request looked like a bot, and a visitor identifier.
That identifier is a SHA-256 hash of a secret salt, the current date, your IP address, and your browser’s user agent. We never store the IP address itself. Because the date is part of the input and the salt is secret, the identifier changes every day and cannot be reversed, so we can count how many people read a page today without being able to recognise you tomorrow or link you to anything else we hold. These records are deleted automatically after 13 months.
The trade is deliberate. We lose returning-visitor tracking and get a measurement system that holds no personal data. To be clear about the limit of that claim, it covers our page-view records only. When you submit a form, and when our abuse controls block a request, your IP address is stored as it is. The privacy policy sets out both.
4. Why there is no consent banner
Consent for cookies comes from the ePrivacy Directive, which requires consent before storing information on, or reading information from, your device. Two things follow from how this Site is built.
First, our analytics stores nothing on your device and reads nothing from it. It is a plain server-side record, so the consent requirement is not engaged, and because the visitor identifier is an irreversible daily hash rather than an identifier for you, the resulting records are not personal data under the GDPR.
Second, the Portal sign-in cookies fall within the exemption for storage that is strictly necessary to provide a service you have explicitly requested. Signing in is the service. A banner asking your permission to remember that you signed in would be theatre.
If we ever add a tracker that does require consent, we will ask for it properly before it loads, and this page will say so.
5. Third parties
The Site is served by our website hosting and DNS provider. Our records live with our cloud database and authentication provider, our email is sent through our transactional email provider, the mailbox that receives your message is run by our business email provider, and an application photo, if you choose to upload one, is stored with our file storage provider. All of them are based in the United States and process data on our instructions. The only one your browser talks to directly during an ordinary visit is our host, and it sets no tracking cookies for us. Uploading a photo involves a direct request to our file storage provider so that the file can be transferred.
We embed no third-party fonts loaded at run time from another company’s servers, no social widgets, and no comment systems. What each of those providers does, and how to find out who it is, is set out in Section 5 of the privacy policy.
6. Controlling cookies yourself
Every major browser lets you block or delete cookies, usually under privacy or site settings. Blocking cookies for umbramodels.com has no effect on the public Site, because it sets none. It will stop you signing in to the Portal, because the sign-in cookie is what keeps you signed in. Clearing cookies signs you out.
7. Do Not Track and Global Privacy Control
We do not track you across other websites, so a Do Not Track header or a Global Privacy Control signal has nothing here to switch off. We treat a Global Privacy Control signal as a valid opt out of any sale or sharing of personal information, and as stated in our privacy policy, we do not sell or share personal information in the first place.
8. Changes to this notice
If we change what we store on your device we update this page and the dates at the top of it before the change goes live, not after. Adding any cookie that is not strictly necessary would be a material change, and we would ask for your consent rather than announce it. The same notice mechanism described in Section 18 of the privacy policy applies here.
9. Questions
Email team@umbramodels.com. If you want the legal detail on what we collect and why, read the privacy policy.