Cookie Notice

A cookie is a small text file that a website asks your browser to store and send back on later visits. Related technologies — local storage, session storage — do a similar job using space in your browser instead of a file sent with each request. This notice covers all of them.

Cookies are usually described in two ways:

• First-party cookies are set by the site you are visiting (studiovisibility.com). Third-party cookies are set by another company's domain.
• Session cookies are deleted when you close your browser. Persistent cookies stay until they expire or you delete them.

"Strictly necessary" has a specific meaning: the cookie is required to deliver a service you actively asked for. Ours exist to sign you in and keep you signed in securely, and to keep the site working and safe. Without them you could not log in or stay logged in, and pages behind the login would not work at all.

Because those cookies are strictly necessary, EU and UK law (the ePrivacy Directive as implemented, including the UK's PECR) does not require us to ask for your consent before setting them — but it does require us to tell you clearly what they are, which is what this page does.

The advertising cookies are a different matter, and we treat them differently:

• In the EEA, the UK, and Switzerland nothing is set and nothing is sent to Meta unless you choose "Accept" on our banner. Closing the banner without choosing means no — we never treat silence as agreement.
• Everywhere else they are on by default, and the banner tells you so with a "Reject" button that is the same size as "Accept". You can also turn them off at any point from this page.
• If your browser sends Global Privacy Control or Do Not Track, they stay off everywhere, we never ask, and no advertising data leaves your browser or our servers. This is how we honor opt-out preference signals under California's CPRA and comparable state laws.

First-party cookies (set by studiovisibility.com)

<project> is the identifier of our Supabase project, so the real cookie name you will see in your browser is a fixed string such as sb-abcdefgh-auth-token.

Local storage (not a cookie, same idea)

Advertising cookies (Meta)

These are set by the Meta pixel, and only when advertising cookies are on for you — see Advertising measurement for what the pixel does and Your advertising choice to turn it off. Both are set on our own domain, so your browser shows them as first-party, but the data goes to Meta:

Turning advertising off from this page deletes both of these and stops any new ones being set.

Third-party cookies

Beyond the Meta pixel described above, we do not embed third-party trackers, social buttons, chat widgets, or session-recording tools in our pages. Two other third parties set their own cookies, but only on their own websites, when you choose to go there:

We also load our display font from Google Fonts at build time and serve it from our own domain, so no request goes to Google when you view a page and no font cookie is set.

We measure basic site traffic — which pages get visited, roughly how many people visit, and which sites send us referrals — so we know what's working. We built this to set no cookie and no persistent identifier, rather than adding a third-party analytics script, because a script like that typically means a new cookie and a new company receiving data about your visit.

Specifically, when you load a page, your browser reports:

• the page path (for example /pricing), never the full URL with query parameters;
• the referring site's domain, if you arrived by a link (not the specific page you came from);
• campaign tags if your link included them (utm_source, utm_medium, utm_campaign);
• a coarse device category (mobile, tablet, or desktop);
• whether you were signed in at the time.

To count unique visitors without a cookie, our server computes a one-way hash of your IP address and browser type, combined with a secret value that changes every day at midnight UTC. That hash is what gets stored — never the IP address itself. Because the secret changes daily, the same visitor produces an unrelated, unrecoverable hash each day: there is no record linking one day's visit to the next, and nothing here can be reversed back to your IP address. This means "unique visitors" is really unique visitors per day — the closest we can get to a real count without tracking anyone.

We honor Global Privacy Control and the browser's Do Not Track setting: if either is present, no traffic data is sent or recorded for that visit, full stop. This measurement never runs on pages inside /admin, is never combined with advertising or profiling of any kind, is never sold or shared with anyone, and is visible only to us, internally, as aggregate counts — never as a list of individual visits or visitors.

We advertise on Facebook and Instagram. To know whether that money is doing anything — rather than guessing — we measure which ads lead to signups and purchases. That measurement has two halves, and we would rather describe both plainly than let you discover the second one in a network log.

The pixel, in your browser

When advertising cookies are on for you, we load Meta's fbevents.js script. It sets the _fbp and _fbc cookies listed above and tells Meta which of our pages you viewed. We deliberately turn off Meta's "Automatic Advanced Matching", a feature that would otherwise read values out of the forms on the page — including your email address as you type it into our signup form — and send them to Meta without either of us choosing to.

The Conversions API, from our servers

When you sign up, start a checkout, or complete a purchase, our own server also reports that event to Meta directly. We do this because browser-based pixels are blocked or curtailed for a large share of people, which makes advertising reports wrong in a way that costs us money. What we send:

• the event and, for a purchase, the amount and currency (net of any sales tax);
• your email address as an irreversible SHA-256 hash, never in the clear — Meta can only use it to check against a hash it already holds;
• a hashed identifier for your account, the _fbp / _fbc values above, and your IP address and browser user-agent string, which Meta requires in order to match an event to a browser it has already seen.

We do not send your name, your business name, your website, your scan results, or anything you have entered into the product. Meta acts as an independent controller for this data under its Business Tools Terms, and its own Privacy Policy governs what it does with it.

None of this runs — neither the pixel nor the server-side reporting — if advertising cookies are off for you. The server checks your choice before it sends anything, and a purchase records the answer that was in force when you started checkout.

This is the live setting for the browser you are reading this in. Changing it takes effect immediately — there is nothing to save and no confirmation step.

If you are in the EEA, the UK, or Switzerland, it will already say "off" unless you accepted our banner, because nothing loads there until you do.

Turning advertising off stops any further data reaching Meta and deletes the two Meta cookies from this browser. It cannot delete what Meta already received before you changed the setting — for that, use the Meta Accounts Center, where you can see and disconnect off-Meta activity attributed to you, or email us at support@studiovisibility.com and we will make the request on your behalf.

Aside from the Meta advertising cookies described above, Studio Visibility sets no:

• cookies or persistent identifiers for analytics (our traffic measurement sets none — see Aggregate traffic analytics) — and no third-party analytics like Google Analytics;
• social-media cookies or embedded social widgets;
• session-recording, heatmap, or A/B-testing cookies;
• fingerprinting, device-graph, or data-broker identifiers of any kind.

We do not sell personal information as that term is defined under California law — no one pays us for it and we do not trade it.

We do have to be straight with you about the other half of that sentence. Sharing data with Meta so it can measure and target our advertising is very likely "sharing for cross-context behavioral advertising" under California's CPRA, and "targeted advertising" under the Colorado, Connecticut, Virginia and similar state laws. Previously this page said we did neither. Now that we advertise on Meta, that would no longer be true, so we have changed it rather than leave a comfortable sentence standing. What follows from it is a right to opt out, which you can exercise in one click at Your advertising choice above, or automatically by using a browser that sends Global Privacy Control — which we honor without being asked.

An earlier version of this page promised that if we ever added a cookie-based advertising tool we would name it here first, ask for opt-in consent where consent is required, make "reject" as prominent as "accept," honor opt-out preference signals, and let you change your mind from this page. Adding the Meta pixel is us keeping that promise, and the same terms apply to anything we add next:

• this page is updated first, naming the specific provider, the cookie names, what each one is for, and how long it lasts;
• in the EEA, the UK, and Switzerland — and anywhere else consent is required — nothing non-essential is set until you opt in, with "reject" offered as prominently as "accept";
• opt-out preference signals such as Global Privacy Control are honored automatically, without you having to ask;
• your choice can be changed or withdrawn at any time from Your advertising choice;
• access to the Service is never made conditional on accepting any of it — declining costs you nothing.

Nothing beyond what is listed on this page is being set today.

You can see, block, and delete cookies in your browser settings. Every major browser also offers a private-browsing mode that discards cookies when you close the window:

• Chrome
• Safari
• Firefox
• Microsoft Edge

One warning: the cookies that keep you signed in are also the only way to stay signed in, so blocking or deleting all cookies will log you out and prevent you from logging back in. The public pages will still work. If your aim is only to stop the advertising cookies, use Your advertising choice instead — it turns those off and deletes them without touching your login.

Note that clearing your cookies also clears your answer about advertising, since that answer is itself stored in a cookie. Outside the EEA, UK, and Switzerland, where advertising cookies are on unless you turn them off, clearing everything will put them back on and you will see the banner again.

Blocking cookies does not delete any information we already hold. To exercise your rights over that information, see the Privacy Policy.

We will update this page whenever the cookies we use change, and we will revise the "Last updated" date at the top. If we ever introduce non-essential cookies, we will tell you before they are set rather than after.

This notice supplements our Privacy Policy, which explains everything else we do with personal information.

Questions about cookies, or think you have spotted one we have not listed? Email support@studiovisibility.com and we will look into it.

Studio Lifesaver LLC (d/b/a Studio Visibility)
Georgia, United States