VLSTUDIO
← Back to site
Cookie &
Tracking Notice
Contents
3. Cross-Origin Loads on Every Page, Including This One
4. Correcting an Earlier Claim
5. The Legal Framework: ePrivacy Directive & UK PECR
1. What This Notice Covers
This notice covers VLStudio Web at vlstudio.live: what it stores on your device (in your browser's local storage and session storage) and what it loads from other domains every time a page renders, including legal pages like this one. It does not cover the VLStudio Desktop application, which does not run in a browser and is covered instead by our Privacy Policy.
VLStudio Web does not set traditional HTTP cookies for tracking or advertising purposes. That is a narrower claim than "we do not track you", and this notice explains why: browser storage and cross-origin script loading are, in substance, the same category of concern that cookie law was written to address, and they are present on this site today.
2. Client-Side Storage We Use
The table below is a full inventory of what VLStudio Web writes to your browser. Nothing in this table is a third-party advertising cookie.
| Item | Storage type | Purpose | Lifespan |
|---|---|---|---|
| Supabase auth session token | Local storage | Keeps you signed in between visits and authenticates your requests to our backend | Until you sign out or the session expires |
| PKCE state / nonce value | Session storage | A one-time value used only during the OAuth sign-in handshake, to confirm the sign-in response matches the request that started it | Cleared once sign-in completes or the tab closes |
| Per-user UI preference keys | Local storage | Remembers interface choices tied to your account, for example layout or dashboard view preferences | Until you clear it or it is overwritten |
None of this storage is used to build an advertising profile of you, and none of it is shared with an ad network. It exists to make the site function for a signed-in user.
3. Cross-Origin Loads
We keep third-party loads on this site to a minimum, and describe the remaining ones plainly:
- Fonts are self-hosted. Every page, including the legal pages, loads its fonts from our own domain. No request goes to Google Fonts when a page renders.
- Stripe is not loaded on our pages. Payment happens on Stripe's own hosted checkout and billing-portal pages, which you are redirected to only when you choose to subscribe or manage billing. Stripe's own privacy terms apply on those pages.
- CDN-hosted front-end scripts (the React runtime and our database client) are loaded from public CDNs with integrity pinning. Loading them transfers your IP address and browser details to the CDN on page view, as any web resource load does.
- Vercel Web Analytics, our hosting provider's cookieless analytics, records aggregate page-view metrics without cookies or cross-site identifiers.
4. Correcting an Earlier Claim
An earlier version of this site loaded Google Fonts and Stripe.js on every page, transferring visitor IP addresses to those companies on each page view, and an earlier version of this notice disclosed that. Both loads have since been removed: fonts are now self-hosted and Stripe code runs only on Stripe's own checkout pages. The remaining cross-origin loads are the CDN scripts and cookieless analytics described in Section 3.
5. The Legal Framework: ePrivacy Directive & UK PECR
The EU ePrivacy Directive (as implemented in Spain and other member states) and the UK Privacy and Electronic Communications Regulations (PECR) both regulate storing information on, or reading information from, a user's device. That rule is not limited to cookies by name: it covers local storage, session storage, and any comparable client-side mechanism, and by extension it is the same policy concern engaged when a page pulls in a cross-origin resource as part of loading.
Under this framework, storing or reading device information generally requires either the user's informed consent or falls within a narrow "strictly necessary" exemption (for example, a session token needed to keep you logged in for a service you asked for). Items in Section 2 that are strictly necessary to sign-in and session continuity, the auth token and the PKCE nonce, can likely rely on that exemption. The Google Fonts and Stripe.js loads described in Section 3 are harder to justify as strictly necessary on every page, including pages, like this one, that have nothing to do with payment or checkout, and are the clearest candidates for requiring consent or removal once a consent mechanism exists.
6. No Consent Banner Yet: What You Can Do Today
Until a consent tool ships, here is what you can do at the browser level to reduce these loads:
- Use a browser extension or built-in setting that blocks third-party font and script loading (most modern browsers and ad-blocking extensions can do this).
- Use your browser's tracking-protection or "strict" privacy mode, which typically blocks or isolates cross-origin requests like the Google Fonts and Stripe.js loads described above.
- Clear local storage and session storage for vlstudio.live from your browser's site-data settings at any time; this will sign you out and require you to sign in again.
- Use private/incognito browsing if you do not want the auth token or UI preference keys to persist between sessions.
None of these browser-level steps require our involvement, and none of them will break core site functionality other than requiring you to sign in again if you clear storage.
7. What We Do Not Use
VLStudio Web does not run third-party advertising trackers, does not use cookies to build cross-site advertising profiles, and does not sell browsing data to data brokers or ad networks. The gap described in this notice is about non-essential technical loads (fonts, payment scripting) and the absence of a consent mechanism for them, not about hidden advertising tracking.
8. Changes to This Notice
We will update this notice as the underlying technical facts change, in particular once Google Fonts is self-hosted and once a real consent-management mechanism ships. See our Terms Versioning Policy for how material changes to any VLStudio legal document are announced.
9. Contact
Questions about this notice or about the storage and cross-origin loads it describes:
- Email: vlstudiopartners@hotmail.com, interim address: vlstudiopartners@hotmail.com
- Postal: Vladyslav Zhminko, Calle de Valencia 191, Piso 6, Puerta 1, 08011, Barcelona, Spain
- Related: our Privacy Policy, Section 13 summarizes this notice; this page is the full detail.