Cookie Policy

Cookies and similar storage technologies (such as localStorage and sessionStorage entries set by the browser) are small data items stored on a visitor's device by the websites the visitor uses. They allow a site to recognise a returning user, maintain an authenticated session, remember preferences, and operate integrated services such as billing checkout flows. This policy explains how StateTilt uses cookies and how visitors can control them. It complements the Privacy Policy, which describes how personal data more generally is processed.

• Strictly necessary. Required for the site to function. These include session-authentication cookies set by Clerk on the StateTilt domain to keep a signed-in user authenticated, and cross-site-request-forgery tokens that protect form submissions. These cookies are first-party with respect to StateTilt and are exempt from consent under the e-Privacy Directive Article 5 strictly-necessary exemption.
• Functional. Remember non-essential preferences such as colour theme and locale. Functional cookies are set only after the visitor expresses a relevant preference and are first-party.
• Vendor (third-party). Set by sub-processors that StateTilt embeds on specific pages. The Clerk authentication widget sets cookies on its own domain when it loads the sign-in flow. Lemon Squeezy sets cookies on its checkout domain when a subscriber initiates billing. These third-party cookies are governed by the policies of those vendors; StateTilt does not control their lifetime or storage location independently of the vendors' published terms.
• Analytics. StateTilt uses a privacy-friendly, cookieless analytics tool (Umami) to understand aggregate site traffic. It sets no cookies, stores nothing on the visitor's device, and is configured not to store personal data or track visitors across other sites. Because it sets no cookies, we do not show a cookie-consent banner for it. If StateTilt later introduces analytics that do set cookies or process personal data, this policy and a consent mechanism will be updated before the change takes effect.

The table below lists the cookies known to be set on or via the StateTilt domain at publication time. Vendor-set cookies on the vendor's own domain are governed by the vendor's published cookie inventory (linked under each row). The list is illustrative rather than exhaustive; subscribers should consult the linked vendor pages for the authoritative inventory.

For the authoritative cookie inventories, see Clerk at clerk.com/legal/dpa and Lemon Squeezy at lemonsqueezy.com/dpa.

For visitors located in the European Economic Area or the United Kingdom, e-Privacy Directive Article 5 requires informed consent before any non-essential cookie is set on the visitor's device. Strictly necessary cookies (such as the session-authentication and cross-site-request-forgery tokens described above) are exempt. StateTilt sets no analytics or marketing cookies — the analytics tool it uses (Umami) is cookieless — so no consent banner is shown. Should StateTilt introduce non-essential cookies, a consent mechanism that meets the applicable e-Privacy and GDPR consent standards will be implemented before the relevant cookie is set, and this policy will be revised accordingly.

Most browsers allow the visitor to view, restrict, or delete cookies through the browser settings. Disabling strictly necessary cookies will prevent the site from operating correctly: the visitor will not be able to sign in, and checkout will fail. Disabling functional cookies will reset preferences such as colour theme on each visit. Visitors may also withdraw consent for functional cookies they previously accepted by clearing the cookie store in their browser. Vendor-set cookies on the vendor's own domain can be reviewed and removed using the same browser controls.

Session cookies are removed when the visitor closes the browser session. Persistent cookies have explicit lifetimes set by the issuer; the typical maximum on the StateTilt domain is the 90-day window used by Clerk for authenticated-session continuity, after which a fresh sign-in is required. Vendor-set persistent cookies follow the vendor's published lifetime.

StateTilt may revise this Cookie Policy when the cookies it sets change, when sub-processors update their cookie behaviour, or when applicable law changes. Material changes will be announced through the channel a subscriber has registered with and posted on this page with a revised “Last updated” date.