Cookie and Storage Policy
Version 1 · In force from 22 September 2026 · Last updated 13 October 2026
This policy covers everything Curate stores on your device or reads from it — not only cookies. The rules that apply (PECR regulation 6 in the UK, as amended by the Data (Use and Access) Act 2025, and Article 5(3) of the ePrivacy Directive in the EU) are written in terms of storing or gaining access to information on your device, so local storage, session storage, a database in your browser and reading your device's light/dark setting all count.
The short version
- Essential storage keeps you signed in, keeps your work from being lost, and remembers the choices you make here. It cannot be switched off, because without it the service does not work.
- Display preferences — remembering light or dark, and matching your device's setting — are on unless you object. You can object at any time, and we then stop and clear what was stored.
- Analytics is off unless you allow it. Nothing is loaded, and nothing is sent, until you choose “Allow”. Rejecting takes one click, exactly like allowing.
- We ask once, and remember your answer for about six months. You can change it whenever you like.
What is stored, and why
Third-party items are set by a provider we use rather than by us, and their own policies also apply. Clerk's exact set of sign-in cookies depends on how authentication is configured, and the payment cookies only appear while a checkout is open.
Essential
Needed to sign you in, keep your work safe and remember the choices you make here. These cannot be switched off.
| Name | Type | Set by | What it does | How long it lasts | Why we can use it |
|---|---|---|---|---|---|
| __session, __session_<suffix> | Cookie | Clerk first party | Keeps you signed in. Holds the short-lived token every page and API route checks. | Refreshed continuously while you are signed in | Strictly necessary — authenticating you (PECR Sch A1 para 4) |
| __client_uat, __client_uat_<suffix> | Cookie | Clerk first party | Records when your sign-in state last changed, so the app knows whether to look for a session. Set to 0 when you are signed out. | Up to 1 year | Strictly necessary — part of the sign-in mechanism (PECR Sch A1 para 4) |
| __client | Cookie | Clerk third party | Identifies your browser to the authentication service. | Long-lived, managed by Clerk | Strictly necessary — authentication (PECR Sch A1 para 4) |
| __refresh_<suffix>, __clerk_handshake, __clerk_handshake_nonce, __clerk_redirect_count | Cookie | Clerk first party | Renews an expired session and prevents redirect loops while it happens. | Seconds to minutes | Strictly necessary — authentication (PECR Sch A1 para 4) |
| __cf_bm and Cloudflare Turnstile storage | Cookie | Cloudflare, via Clerk third party | Tells real sign-ups from bots. Signing up or signing in, when bot protection is enabled. | Up to 30 minutes | Strictly necessary — security and fraud prevention (PECR Sch A1 para 4) |
| __stripe_mid, __stripe_sid | Cookie | Stripe, via Clerk Billing third party | Detects card fraud during checkout. Only while a billing checkout is open. | 1 year / 30 minutes | Strictly necessary — fraud prevention for a payment you asked to make |
| curate_consent | Cookie | Curate first party | Remembers your analytics choice, so we stop asking. | 6 months | Strictly necessary — storing the choice you made (and expressly exempt) |
| curate_prefs | Cookie | Curate first party | Records that you objected to us remembering display preferences. | 1 year | Strictly necessary — storing your objection so we keep honouring it |
| curate_terms_later | Session storage | Curate first party | Keeps a prompt collapsed after you choose "Later" or "Not yet" — the Terms prompt and the one asking whether to start a new plan. | Until you close the tab | Strictly necessary — a record of a selection you made (PECR Sch A1 para 4) |
| flow-v2-nodes-<project>, flow-v2-edges-<project>, flow-v2-meta-<project>, flow-v2-unsynced-<project> | Local storage | Curate first party | Saves your pipeline as you build it, so a reload or a lost connection does not lose your work, and marks a project whose latest changes have not reached our servers yet. It can include product data from your uploads. | Until you sign out or clear it. Kept when you sign out if our servers have not yet confirmed your latest changes; the unsynced marker goes once they do. | Strictly necessary — keeping information you put into the service (PECR Sch A1 para 4) |
| flow-nodes-<project>, flow-edges-<project>, column-mapper-<project>-<node>, column-mapper-<project>-<node>-auto, edit-data-node-<project>-<node>, image-upload-node-<project>-<node>, font-upload-node-<project>-<node>, template-generator-<project>-<node> | Local storage | Curate first party | Your work in the older canvas — the layout, your column mappings and edits, and the images, fonts and templates you added. Kept so it can be migrated. Only for projects that started on the previous canvas. | Until you clear it. Not removed when you sign out, because for a project opened on the previous canvas this is the only copy. | Strictly necessary — keeping information you put into the service |
| image-cache-<project>-<node>, generation-progress-<project>-<node> | Local storage | Curate first party | Caches images you have generated and lets a run recover if it is interrupted. | Until you sign out or clear it. Kept when you sign out if our servers have not yet confirmed the latest changes to that project. | Strictly necessary — delivering and recovering the output you asked for |
| visualise-db | Database on your device | Curate first party | Holds generated images on your device so a long run can resume. Only in the previous canvas. | Until you sign out or clear it. Kept when you sign out if our servers have not yet confirmed the latest changes to any project. | Strictly necessary — delivering and recovering the output you asked for |
| flow-v2-guide-<project> | Local storage | Curate first party | Remembers that you closed the Assistant panel, with its setup checklist, on a project whose pipeline Curate built for you, so it no longer opens by itself there. | Until you clear it | Strictly necessary — a record of a selection you made (PECR Sch A1 para 4) |
| flow-v2-guide-ms-<project> | Local storage | Curate first party | Records which setup steps a project has already reported as reached, so the same step is not sent to us twice. | Until you clear it | Strictly necessary — preventing a duplicate of a message the app sends about your own project |
| flow-v2-legend-open | Session storage | Curate first party | Remembers whether the canvas legend is open. Only on the /dev/flow-v2 preview canvas. | Until you close the tab | Strictly necessary — a record of a selection you made, for this visit only |
Display preferences
Remembers your light or dark appearance and matches your device setting. Switch this off and Curate will stop, and clear what it has stored.
| Name | Type | Set by | What it does | How long it lasts | Why we can use it |
|---|---|---|---|---|---|
| theme | Local storage | Curate first party | Remembers whether you chose the light or dark appearance. | Until you change it or clear it | Appearance exception (PECR Sch A1 para 6) — you can object in Cookie settings |
| Device light/dark setting | Read from your device | Curate first party | Reads whether your device is set to light or dark mode, so Curate matches it until you choose otherwise. Object, and we stop following it and show a light appearance instead. | Read on each page load; not stored | Appearance exception (PECR Sch A1 para 6) — you can object in Cookie settings |
Analytics
Vercel Web Analytics, which counts visits so we can improve Curate. Off unless you allow it.
| Name | Type | Set by | What it does | How long it lasts | Why we can use it |
|---|---|---|---|---|---|
| Vercel Web Analytics | Read from your device | Vercel third party | Counts page visits and records the page address, where you arrived from, and your device and browser type, so we can see which parts of Curate are used. It sets no cookies, it stores one item in your browser, and it does not run unless you allow it. Only after you choose "Allow analytics". | Vercel keeps the reports. The one thing it stores on your device is the next item. | Your consent (PECR Sch A1 para 2 / ePrivacy Art 5(3)) |
| __va_attribution | Local storage | Vercel third party | Records where you arrived from, so a visit is counted against the right referrer rather than counted again as a new one. Only after you choose "Allow analytics". | Until you switch analytics off or clear it. We remove it as soon as you switch analytics off. | Your consent (PECR Sch A1 para 2 / ePrivacy Art 5(3)) |
Analytics
We use Vercel Web Analytics to count page visits, which we use to see which parts of Curate people actually use. It sets no cookies and creates no identifier for you, but it does send a request from your browser, which is why we ask before it runs.
- It does not load at all until you choose “Allow”.
- When it does run, each page view sends the page address with query strings removed and project identifiers replaced by a placeholder, the page you came from, and your device and browser type.
- Withdrawing takes effect immediately — the next page view sends nothing. We also remove the one item Vercel's script stores in your browser (
__va_attribution).
There is no advertising, no profiling and no tracking across other websites, and we do not use Google Analytics or anything like it.
Objecting to display preferences
Remembering your appearance falls under the appearance exception in the UK rules, which allows it as long as we tell you clearly and give you a simple, free way to object. Two ways to object:
- Switch Display preferences off in Cookie settings. Curate then stops following your device's light/dark setting, stops keeping your choice between visits, and clears what was stored. A theme you pick lasts for that browser session only.
- Or simply choose light or dark explicitly in the theme menu. Your device's setting is then no longer followed.
Your objection is itself remembered, in a cookie that does nothing else, so that we keep honouring it.
Managing and clearing storage yourself
- Every browser can block or delete cookies and site data for a site. Blocking essential items will stop you being able to sign in, and may lose unsaved work.
- Signing out clears the working copies of your projects that Curate keeps on your device. It keeps your analytics answer and your objection to display preferences, so we do not ask again or forget what you told us.
- Your answer to the analytics question applies to the browser you gave it in. On another browser or device, we will ask again.
- If you use more than one tab, a change in one takes effect in the others.
Changes to this policy
If we add anything that needs your permission, we will ask again before it runs, and publish a new version of this policy. The version number and date are at the top of the page, and superseded versions stay available at their archive URLs.
Questions about anything on this page: chris@curatestudio.dev. How we use personal data more generally is in the Privacy Policy.