What this covers
“Cookies” is the shorthand, but this page covers every way the site stores something on your device — HTTP cookies, localStorage and sessionStorage. They raise the same question and get the same answer here.
There are two categories, and the consent banner uses exactly these names: necessary, which is always on because without it the site does not function, and analytics, which is off until you turn it on. There is no third category, because there is nothing else to put in one.
What the site does with the information behind these keys is set out in the Privacy Policy.
Strictly necessary
These cannot be switched off. They carry no analytics and no advertising — each one exists because a specific part of the site would otherwise break.
- Signing in. Our authentication provider, Supabase, sets a session cookie when you sign in and refreshes it as you browse. It is what tells the server that the person asking for your bookings is you. Without it there is no member area at all. It is large enough that browsers sometimes split it across numbered parts — same cookie, two pieces.
- Completing a sign-in.A short-lived cookie holds a one-time verifier while you move between the sign-in form (or a password-reset email) and the page you land on. It is deleted the moment sign-in completes, and it is what stops somebody else’s link finishing your sign-in.
- Remembering your cookie choice. Your answer to the banner is kept in
localStorage. If it were not, the banner would ask again on every page — which is both worse for you and, in effect, not a choice at all. - Remembering a dismissed notice. When the studio is running a site-wide notice, closing it is remembered for the rest of the visit in
sessionStorage, so it does not reappear on the next page. It is gone when you close the tab.
Analytics
We use Vercel Analytics and Vercel Speed Insights to see which pages get used and how quickly the site loads on real devices. That is the whole purpose: no funnels, no user-level session replay, no advertising audiences.
Both are cookieless. They set nothing on your device, and there is no identifier for us — or anyone else — to follow you around with. A page view is counted; you are not.
They are still opt-in. Even a cookieless script is a request to a third party carrying your IP address and user agent, so we do not load either one until you have accepted analytics. Decline, and the scripts are never added to the page — not loaded and disabled, but absent. Your choice is remembered in epc.consent.v1, which is a necessary key precisely because it is what keeps analytics off.
What this site does not set
This site sets no advertising cookies and does no cross-site tracking. Specifically, there is no advertising pixel, no remarketing tag, no social-network tracker, no data broker, no cross-site identifier, no device fingerprinting, and nothing that follows you to another website. We do not sell or share what we measure.
One thing that is not a cookie but is worth naming anyway: if the studio has chosen a Google font for the site, your browser fetches it from Google’s servers, and Google sees the request — your IP address and browser — as it would for any file. No cookie is set by it. When the site is running its own bundled fonts, which is how it ships, that request is never made.
The full list
Everything, in one table. <project>stands for our database project’s identifier, which is fixed for this site.
| Name | Type | Category | Purpose | Duration |
|---|---|---|---|---|
| sb-<project>-auth-token | Cookie (first party) | Necessary | Keeps you signed in and authorises every request to your account. May be split across numbered parts when it is large. | Refreshed as you browse; cleared when you sign out or the session expires |
| sb-<project>-auth-token-code-verifier | Cookie (first party) | Necessary | Holds the one-time verifier that completes a sign-in or a password reset securely. | Minutes — deleted as soon as sign-in completes |
| epc.consent.v1 | localStorage | Necessary | Remembers whether you accepted or declined analytics, so the banner stops asking. | Until you change it or clear your browser storage |
| epc.notice.<notice> | sessionStorage | Necessary | Remembers that you closed the studio’s site notice, so it does not reopen on the next page. Only present while a notice is running. | Until you close the tab |
| — none — | Vercel Analytics & Speed Insights | Analytics | Counts page views and measures real-device load performance. Loaded only after you accept analytics. | Sets nothing on your device |
Changing your choice
Your choice is yours to change, at any time, and changing it is one click from every page of the site.
- Open Cookie settings in the site footer. The banner reopens with your current choice showing, and you can accept or decline analytics.
- Declining takes effect immediately for every page you load afterwards. Reload the page you are on and the analytics scripts are gone from it too.
- Clearing your browser storage clears the record of your choice, so the banner will ask again the next time you visit. That is the banner working, not a bug.
Browser-level controls
You can also control this at the browser, which works across every site rather than just ours. Every major browser lets you block or delete cookies and site data, usually under Settings → Privacy. Look for “Cookies and site data” in Chrome and Edge, “Cookies and Site Data” in Firefox, and “Privacy” in Safari.
Be aware of the trade: blocking cookies for this site blocks the sign-in cookie with them, and the member area — your bookings, your credits, your receipts — will not work. Private or incognito windows clear everything on close, so the banner asks again on every visit.
Browser “Do Not Track” and Global Privacy Control signals are not a substitute for the choice above, because our analytics are off by default until you say otherwise.
Changes to this policy
If we add or remove anything, this page and the table above change with it, and the date at the top moves. A new category would need your consent before it did anything — the banner would ask again rather than assume the answer you gave to a different question.
Questions about any of this go to the Data Protection Officer at contact@theelitepilatesclub.com.