COOKIE POLICY
Lathe Studio LLC
Last Updated: October 8, 2026
Introduction
The present Cookie Policy explains how Lathe Studio LLC (“Lathe Studio,” “we,” “us,” or “our”) uses cookies and comparable storage technologies on the website at https://lathe.studio and within the signed-in application of the Lathe Studio test management platform (together, the “Service”). It supplements our Privacy Policy at https://lathe.studio/privacy, which describes the wider processing of personal data, and should be read together with it.
1. Cookies and Similar Technologies
1.1 Cookies
A cookie is a small text file that a website places in the browser of the device used to visit it, so that the site can recognize that browser on later requests. Cookies set by the domain the visitor is browsing are called first-party cookies; cookies set by another domain are called third-party cookies. Session cookies disappear when the browser closes, while persistent cookies remain until they expire or are deleted.
1.2 Local Storage
Browsers also offer a storage area, commonly called local storage or web storage, in which a website may keep information on the device without sending it to a server with every request. We use local storage for a single purpose: to remember the choice each visitor makes on our cookie banner.
1.3 Legal Framework
Within the European Economic Area, storing information on a user’s device, or accessing information already stored there, requires consent unless the storage or access is strictly necessary to provide a service the user has explicitly requested, under Article 5(3) of Directive 2002/58/EC on privacy and electronic communications, as amended by Directive 2009/136/EC. In the United Kingdom, regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, together with Schedule A1 to those Regulations as introduced by the Data (Use and Access) Act 2025 with effect from February 5, 2026, sets an equivalent rule and its exceptions. Both regimes apply to cookies and to local storage alike. Where cookies involve personal data, the General Data Protection Regulation (EU) 2016/679 and the United Kingdom General Data Protection Regulation also apply.
2. How We Use These Technologies
2.1 Strictly Necessary Technologies
The signed-in application cannot function without the cookies set by our authentication provider, Clerk, which keep a user securely signed in and protect the session against misuse. Equally necessary is the entry in local storage that records a visitor’s cookie choice, since without it the banner would reappear on every page and the choice could not be respected. These technologies fall within the exemptions for strictly necessary storage under the laws described in Section 1.3, and they are therefore used without consent. Blocking the authentication cookies through browser settings will prevent sign-in.
2.2 Analytics Cookies
On our marketing pages only, and only after a visitor has clicked to accept analytics cookies on our banner, we load Google Analytics to understand how visitors use those pages, such as which pages are viewed and how visitors arrive at them. Google Analytics is never loaded inside the signed-in application, and on the marketing pages its script is not loaded at all until consent is given, so that Google Analytics neither places cookies nor collects any data for a visitor who has not consented. Although the law of the United Kingdom now allows certain statistical cookies without prior consent, we continue to ask every visitor for consent before any analytics cookie is placed.
2.3 What We Do Not Use
We use no advertising cookies, no cross-site tracking or retargeting technologies, and no social media pixels.
3. Cookies and Storage Entries in Use
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| __session | Clerk, on the domain of the application | Holds a short-lived session token that proves the user is signed in; the token inside the cookie is valid for about sixty (60) seconds and is renewed automatically while the user remains active | Strictly necessary | Persistent; the cookie is replaced as tokens are renewed and its contents become invalid at sign-out |
| __client_uat | Clerk, on the domain of the application | Records the time the sign-in state last changed, allowing the application to tell whether a user is signed in or signed out | Strictly necessary | Persistent, as managed by Clerk |
| __client | Clerk, on the authentication subdomain of the application | Holds the long-lived client token that keeps the sign-in session alive and allows new session tokens to be issued; inaccessible to scripts (HttpOnly) | Strictly necessary | Until the session ends or expires, within the maximum lifetime the browser allows |
| lathe-cookie-consent | Lathe Studio, in local storage | Records the visitor’s choice on the cookie banner, with the value “accepted” or “rejected” | Strictly necessary | Until the choice is changed through “Cookie settings” or the local storage of the site is cleared |
| _ga | Google Analytics, on the marketing pages | Distinguishes one visitor from another | Analytics, consent required | Two (2) years |
| _ga_<container-id> | Google Analytics, on the marketing pages | Persists the state of a visit (session) | Analytics, consent required | Two (2) years |
Clerk may also set short-lived technical cookies during the sign-in flow, and variants of the cookies listed above whose names carry a suffix; they serve the same strictly necessary purpose. According to Google, Google Analytics 4 does not log or store IP addresses, although it uses them at the time of collection to derive approximate location. Further information on Google Analytics cookies is published by Google at https://support.google.com/analytics/answer/11397207 (opens in a new tab).
4. Payment Pages
Subscriptions are purchased and managed through Stripe Checkout and the Stripe billing portal, both hosted by our payment processor, Stripe, on its own domains. The Stripe.js script is not loaded on lathe.studio, and Stripe therefore places no cookies through our pages. Any cookies set while a visitor uses the Stripe pages are placed by Stripe under its own responsibility and are described in the Stripe Cookie Policy at https://stripe.com/legal/cookies-policy (opens in a new tab).
5. Managing Your Choices
5.1 Through Our Banner
On a first visit, our banner allows each visitor to accept analytics cookies or to refuse them by clicking “Reject non-essential.” Refusing has no effect on access to any part of the website or the Service.
5.2 Changing a Previous Choice
A visitor may withdraw consent, or give it later, at any time by selecting the “Cookie settings” link in the footer of our website, which reopens the banner so that a new choice can be made. Once consent is withdrawn, Google Analytics is no longer loaded on subsequent page loads, while analytics cookies already placed can be deleted through the browser controls described in Section 5.3. Withdrawal does not affect the lawfulness of analytics carried out before it.
5.3 Browser Controls
Most browsers allow users to view, block, and delete cookies and site data through their settings; the help pages of each browser explain how. Blocking the strictly necessary cookies described in Section 3 will prevent sign-in to the application. Google also offers a browser add-on that prevents Google Analytics from collecting data on any website, available at https://tools.google.com/dlpage/gaoptout (opens in a new tab).
6. Changes to the Cookie Policy
We will revise the present Cookie Policy whenever we add, remove, or change the purpose of a cookie or storage technology. The “Last Updated” date at the top shows the most recent revision, and where a change requires fresh consent, the banner will ask for it again.
7. Contact
Questions about cookies or about our use of personal data may be sent to privacy@lathe.studio, or by post to Lathe Studio LLC, 1309 Coffeen Ave STE 1200, Sheridan, Wyoming 82801, United States.