Back to Settings

Legal

Cookie Policy

Last updated: 20 October 2026

This Cookie Policy explains the cookies and similar storage STUDEO actually uses. It sits next to our Privacy Policy.

A cookie is a small file the site stores in your browser. We also use local storage and session storage. Those are not cookies, but they keep information on your device, so they belong here too.

Names, purposes and lifetimes below come from the current STUDEO code. Where a provider may set its own cookies and this repository does not name them, we say so. We do not invent names or expiry dates.

1. What we do not use

The current application does not include:

  • advertising cookies;
  • retargeting or social-media pixels;
  • a cookie banner;
  • a preference centre for accepting, rejecting or withdrawing cookie consent.

Favourites, saved studios and the language stored on your account live in STUDEO's database once you are signed in. They are not cookies.

Studio search filters travel in the page address. Email is sent from our servers through Resend. That does not place a Resend cookie in your browser.

2. Strictly necessary cookies

These cookies are written so that a feature you are using can work. Under the rules that apply in Spain, storage that is strictly necessary for a service you request does not need a prior consent banner. You can still delete these cookies in your browser. Parts of STUDEO will then stop working until they are set again.

studeo_locale

First-party. Set when you choose English, Spanish or Catalan on the website.

It remembers that choice for one year (Max-Age 31536000 seconds). On HTTPS it is marked Secure. SameSite is Lax.

Choosing a language is something you do. The cookie is how the site keeps that choice. It is not advertising.

studeo_flow_locale

First-party. Set for checkout and related flows so the language of the page you were on continues after a login return. It does not replace studeo_locale.

No Max-Age is set, so the browser treats it as a session cookie and drops it when the session ends.

studeo.authNext

First-party. Stores the safe path to return to after you sign in. Kept for 30 minutes, then removed. SameSite is Lax.

studeo-settings-hub

First-party. Remembers whether you last used owner or artist settings, so the settings area opens on the right side. Kept for 30 days (Max-Age 2592000 seconds). SameSite is Lax.

studeo.gcal_oauth

First-party. HttpOnly. Set only while you connect Google Calendar, and only on the callback path. It holds the OAuth state used to prevent a forged return. Lifetime is 10 minutes.

Supabase Auth cookies

First-party cookies whose names start with sb- and include auth-token. Supabase Auth, through the application, uses them to keep you signed in. During login it may also set a short-lived code-verifier cookie for the sign-in proof.

This repository does not fix their expiry. Supabase Auth sets that lifetime. They are cleared when you sign out or when the session ends. Exact cookie names depend on the Supabase project reference and are not listed as fixed strings here.

3. Storage that is not a cookie

Session storage lasts until you close the tab. Local storage stays until the feature removes it or you clear site data. None of the keys below have an expiry date in the code. None of them are used for advertising.

Session storage

  • studeo.bookingDraft.v1: followed by the booking — unfinished booking notes for this tab;
  • studeo.holdAttempt.v1: followed by the attempt — one idempotency id so a double submit does not create two holds;
  • studeo.multiCheckoutQueue.v1 — the remaining dates in a multi-session checkout;
  • studeo.weeklySpotBatch.v1 — the Weekly Spot batch being paid in this tab;
  • studeo.resumeCheckout.v1 — where to resume checkout after you sign in;
  • studeo:nearbyCoords — coordinates for a Nearby search, kept off the address bar;
  • studeo:discoverySeed — a rotation seed for discovery in this tab;
  • studeo-settings-hub — the settings return path for this tab;
  • studeo-portal-notifications-inbox:owner or :artist — which inbox tab you last opened.

Local storage

  • studeo:owner-onboarding — a draft studio listing while onboarding is open. Removed when that flow clears it. Photos in this draft are remote URLs only;
  • studeo-owner-sidebar-collapsed, studeo-artist-sidebar-collapsed and studeo-settings-sidebar-collapsed — whether that sidebar is collapsed;
  • studeo.event-rail-width — the width of the event editor rail;
  • studeo.dismissedSeriesRequests — series requests you have dismissed;
  • studeo.bookingAddedNotice — booking notices you have dismissed;
  • studeo-notice-prefs — which in-product notices you have closed;
  • studeo-cancel-role — the role last selected in the cancellation explainer.

4. Other services loaded in the browser

These services are loaded by STUDEO. Their own cookies were not observed in a clean browser session for this version of the policy. Treat the names below as what our code does, not as a captured cookie jar.

Stripe

Stripe.js and Stripe Connect load when you pay, add a card, or open payout and verification screens. Stripe may set its own cookies on that payment step for fraud prevention and to complete the payment you asked for.

The cookie names and lifetimes are Stripe's. They are not defined in this repository. They are not loaded on ordinary browsing pages that do not mount Stripe.

Google Maps

When a Google Maps key is configured, the Maps JavaScript API loads on screens that show a map or an address search. That includes public studio location and owner address entry. There is no consent step before that script loads.

Google may set its own cookies when that script runs. This repository does not name them. Opening Google Maps in a new tab through a link is a separate visit to Google.

Vercel Web Analytics

The application layout includes Vercel Web Analytics on every page, including before any choice from you. No other analytics product is installed in the repository.

Vercel describes this product as cookieless. That description was not confirmed by inspecting cookies and network requests in a clean browser for this policy. No advertising analytics are configured in the code.

5. Consent

STUDEO does not currently show a cookie banner, and it does not store an accept or reject decision, because no such control exists.

Language, sign-in, checkout drafts and the other storage in sections 2 and 3 are tied to the thing you are doing. We treat them as necessary for that requested service.

Vercel Web Analytics, and Google Maps where a key is configured, load without asking first. If either one is treated as non-essential tracking, a real choice — accept and reject with the same weight, and a way to change your mind — would be required before those tools run. That control is not built yet, and this phase does not add it.

The Privacy Policy describes consent for non-essential cookies in general terms. Where that description is ahead of the product, the product behaviour in this policy is the one to trust until both documents are approved together.

6. How you can limit storage

Your browser can block or delete cookies and site data. If you block strictly necessary cookies, sign-in, language and checkout resume can fail.

Signing out ends the Supabase session. Clearing site data removes the local and session storage listed above, including an unfinished onboarding draft.

7. Changes

If we add a banner, analytics that use cookies, or advertising, this policy has to change first, in English, Spanish and Catalan, with the same facts in each language.