Cookie Policy

Cookies are small data items a website, or a service embedded in it, stores on a visitor's device. Browsers offer related storage, such as localStorage and sessionStorage; this policy covers both and calls all of it “cookies”. The Privacy Policy describes how personal data more generally is processed.

• Strictly necessary. Authentication and security storage, all of it placed by Clerk and by Cloudflare. Where it is stored on the statetilt.com domain it is first-party with respect to StateTilt; on Clerk's own domain it is third-party.
• Analytics. StateTilt uses Umami, a cookieless analytics service, to measure aggregate site traffic and where visitors arrive from. It sets no cookies and stores nothing on the device. Umami's published documentation states that it collects no personally identifiable information and does not track visitors across other sites. No cookie-consent banner is shown for analytics.
• Functional. StateTilt sets none: the product has no colour-theme, language or personalisation setting to remember.
• Marketing and advertising. StateTilt sets none and permits none to be set on its behalf.

StateTilt sets no cookies of its own, and its own page code writes nothing to a visitor's browser storage. Everything below was placed by an embedded service and recorded from a live visit in a browser that had never visited this site and was not signed in.

Cloudflare appears here because Clerk's service runs behind its network, not because StateTilt uses Cloudflare; StateTilt has no agreement with Cloudflare. Clerk maintains the current list of the providers it engages, reached from the sub-processors link on the privacy page. Clerk documents its cookies at clerk.com/docs/guides/how-clerk-works/cookies and the client token at clerk.com/docs/guides/how-clerk-works/overview; its data-processing terms are at clerk.com/legal/dpa. Cloudflare documents its cookies at developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.

In the European Economic Area and the United Kingdom, e-Privacy Directive Article 5 requires informed consent before anything that is not strictly necessary is stored on a visitor's device.

• StateTilt treats the security items placed by Cloudflare as strictly necessary and exempt from consent.
• The authentication items placed by Clerk are strictly necessary in the role they exist for. Because the site header shows sign-in state, Clerk's script runs on every page and these items are placed before any sign-in, whether or not the visitor ever signs in. StateTilt does not assert the strictly-necessary exemption for that case, and does not treat this page as settling it.
• The browser-storage entry saves a request rather than being necessary for the site to work; StateTilt does not claim it as strictly necessary.

If StateTilt introduces storage that is not strictly necessary and not described above, a consent mechanism meeting the applicable e-Privacy and GDPR standards will be implemented before it is written.

Most browsers let a visitor view, restrict or delete cookies and browser storage in their settings, and most offer a mode that discards everything when the session ends. Storage placed on a vendor's own domain is reviewed and removed the same way. Blocking or clearing it signs a signed-in visitor out and prevents signing in; every public page of this site remains readable. StateTilt shows no cookie-consent banner, so there is no in-page control to withdraw a consent given that way.

The period for which a signed-in session stays valid before a visitor must authenticate again is set in the session configuration of StateTilt's own Clerk instance. This policy states no figure for it: the lifetimes above are measured storage lifetimes, not that setting.

StateTilt may revise this policy when what the site stores changes or when the law changes. Material changes are posted here with a revised “Last updated” date and announced through the channel a subscriber has registered with.