Cookie policy · Umoja

1.The short version

A cookie is a small piece of text a website asks your browser to keep and hand back on your next visit. It is how a site remembers anything about you between one page and the next.

We set four cookies. Three keep you signed in and safe while you are; one remembers a layout preference. We run no advertising cookies, no analytics cookies and no third-party trackers — so there is nothing here to opt out of, and no consent banner in your way.

2.Every cookie we set

Name	What it does	Lasts	Type
`umoja_at`	Keeps you signed in. Identifies your session on every request you make.	Until you close your browser	Essential
`umoja_rt`	Renews your session quietly in the background, so you are not asked to sign in again mid-task.	Until you close your browser	Essential
`umoja_csrf`	Stops another website from making requests as you. The page reads this one and echoes it back, which is how we tell your action apart from a forged one.	Until you close your browser	Essential
`umoja_studio_nav`	Remembers whether a creator collapsed the dashboard sidebar, so the page renders the way you left it instead of flickering into place.	1 year	Preference

All four are set by Umoja itself, on this domain. None is set by anyone else, and none is readable by another site.

The two session cookies are marked HTTP-only, which means no script running on the page can read them — including a script an attacker managed to inject. All four are marked SameSite=Lax, so your browser will not send them along with a request another site makes on your behalf.

3.What we do not do

To be specific rather than reassuring:

No advertising or retargeting pixels.
No third-party analytics.
No social media tracking widgets.
No cross-site profiling, and no sale of behavioural data.
No fingerprinting to identify you without a cookie.

If this changes — if we ever add analytics — we will ask for your consent before setting the cookie, not after, and this page will say so before it happens.

4.Why we do not show a consent banner

Consent is required for cookies that are not necessary to provide the service you asked for. Ours are: three are what keep a signed-in session working and secure, and the fourth stores a display preference you set yourself, holds nothing that identifies you, and is only ever set by your own click.

A banner asking permission for cookies you cannot decline without breaking sign-in would be theatre. We would rather list them.

5.Controlling them

Every browser lets you view, block and delete cookies, usually under Settings → Privacy. You can clear ours at any time; doing so signs you out.

Blocking cookies for this site altogether will stop you signing in — there is no other mechanism holding your session. Browsing the marketplace and viewing products works without them.

Deleting umoja_studio_nav costs you nothing but the sidebar preference.

6.Local storage

Alongside cookies, a little data lives in your browser’s own storage rather than in a cookie. It is never sent to us automatically the way a cookie is, and clearing your browsing data removes it.

umoja-cart — what you have added to your cart, so it survives a refresh.
umoja-wishlist — the products you have saved.
Whether you have dismissed a one-off prompt, so it does not reappear.

7.More on how we handle data

Cookies are one small part of it. The privacy policy covers what we collect, who it goes to, how long we keep it and the rights you have over it.