1. About this Policy
This Cookie & Storage Technologies Policy explains how VyuMee Ltd (“VyuMee”, “we”, “us” or “our”) uses cookies and other technologies that store information on, or access information from, a user's device.
It should be read with VyuMee's Privacy Notice. For UK users, these technologies are principally governed by the Privacy and Electronic Communications Regulations 2003, as amended (“PECR”), and, where personal data is involved, the UK GDPR and Data Protection Act 2018.
2. What counts as a storage or access technology
The rules are not limited to traditional browser cookies. Storage or access technologies can include HTTP cookies, browser local storage and session storage, app/device storage, secure credential/token storage, SDKs, scripts and tags, pixels, device identifiers and comparable technologies that store information on or obtain information from a computer, phone, tablet or other terminal equipment.
3. VyuMee's current pre-launch position
At the date of this Policy, VyuMee does not intentionally deploy Google Analytics, Meta Pixel or comparable third-party advertising or cross-site behavioural-tracking technologies.
Current storage uses are limited to authentication and security, user-requested interface preferences, temporary form-draft recovery and secure native-app session storage.
If VyuMee later introduces analytics, advertising, attribution, embedded third-party media, fraud-prevention or other technologies that require consent or a separate objection control, VyuMee will update this Policy and implement the required control before enabling that use where applicable.
4. Authentication and security storage
VyuMee's web platform uses first-party authentication storage so signed-in users can remain authenticated and VyuMee can protect account sessions.
vyumee_sb_access— first-party HTTP-only access-session token with a lifetime linked to the authentication session.vyumee_sb_refresh— first-party HTTP-only refresh token used to renew a session, with a current maximum age of 30 days.
These cookies are configured as HTTP-only, SameSite=Lax, and secure in production. JavaScript running in the browser cannot read HTTP-only cookies.
Legacy/development-only code may use a peek_session first-party cookie when Supabase production persistence is not in use. It is not the intended production authentication mechanism.
These technologies are used for account authentication, session continuity and security. Where the PECR strictly-necessary exception applies, consent is not required for this purpose.
5. Theme and appearance preference
VyuMee can remember a light/dark theme preference using first-party browser local storage under vyumee-theme. Its sole purpose is to adapt VyuMee's appearance to the user's selected theme. It is not used for profiling, advertising or creator recommendations.
Where VyuMee relies on the PECR appearance exception, VyuMee will provide clear information and a simple free means to object or disable the persistent preference. The dedicated storage-preference control is part of VyuMee's pre-launch implementation and must be completed before general public launch. Users can still change the visible theme using VyuMee's theme control.
6. Temporary Founding Creator form drafts
The public Founding Creator expression-of-interest page currently uses first-party browser sessionStorage to preserve an unfinished form during the browser session.
The draft may contain information entered into the form such as creator/public name, email, country, profile links, content category, audience band and selected declarations. It is used only to reduce accidental data loss, is removed following successful submission where possible, and normally expires when the browser/tab session ends.
The submitted application record is separate and is handled as described in the Founding Creator Privacy Notice.
7. Native iOS and Android storage
VyuMee's iOS and Android STORE clients use secure device storage for authenticated session credentials. The current native implementation uses a secure-storage plugin backed by platform security facilities so production authentication tokens are stored in secure device storage rather than ordinary browser local storage.
The native app may also store an interface-theme preference locally. A local-storage session fallback exists only for development builds; production native builds are designed to require secure session storage.
8. Analytics and service measurement
VyuMee may collect server-side operational information, security logs and first-party service events as described in the Privacy Notice. Server-side processing does not by itself mean VyuMee is storing or accessing information on a user's device for PECR purposes.
If VyuMee later uses a client-side analytics or statistical storage technology, VyuMee will assess whether the applicable PECR statistical-purpose exception applies. Where VyuMee relies on that exception, the technology must be used solely for the permitted statistical purpose and VyuMee must provide clear information and a simple free means to object. If an exception does not apply, VyuMee will obtain valid prior consent.
9. Advertising, profiling and cross-service tracking
VyuMee does not currently state that personalised advertising or cross-site behavioural tracking is active.
If VyuMee introduces advertising, retargeting, cross-service profiling, third-party advertising pixels or comparable non-exempt tracking, those technologies will not be treated as strictly necessary. Any consent required by PECR will be obtained before the relevant storage/access occurs.
Consent for advertising or similar tracking will not be inferred merely from using VyuMee or accepting the Terms of Service.
10. Third parties and embedded services
Some VyuMee services use infrastructure and service providers. A provider may process request information on VyuMee's behalf as described in the Privacy Notice.
VyuMee will assess any third-party script, SDK, embed or technology that stores information on or accesses information from a user's device before deployment. Non-essential use requiring consent will not intentionally be enabled before the required user choice is obtained.
11. Consent, objections and user choices
Different storage technologies can have different treatment under PECR. Some may fall within the communication or strictly-necessary exceptions; some appearance or statistical-purpose technologies may be usable without consent only where the statutory conditions are met, including clear information and a simple free means to object; other non-exempt technologies require prior consent.
Where consent is required, VyuMee will seek a freely given, specific, informed and unambiguous choice before the relevant non-essential technology is used. Withdrawing consent must be as easy as giving it.
Until VyuMee's dedicated cookie/storage preference controls are complete, consent-dependent tracking technologies must remain disabled.
12. How long information remains on a device
- access-session storage lasts for the authentication lifetime set by the service;
- the current refresh-token cookie has a maximum age of 30 days unless cleared or replaced earlier;
- Founding Creator
sessionStoragedrafts normally last only for the browser/tab session and are removed after successful submission where possible; - the
vyumee-themepreference can remain until replaced, removed through VyuMee's storage controls or cleared through browser/device controls; and - secure native session material lasts only as needed to maintain the signed-in session and is removed or replaced through sign-out/session-management processes.
13. Browser and device controls
Browsers and operating systems commonly allow users to delete cookies/local site data, block certain technologies, clear app storage or reset permissions. Doing so may sign a user out, remove a saved theme preference or clear a temporary form draft.
Browser or device settings do not replace a VyuMee consent or objection mechanism where the law requires VyuMee itself to provide one.
14. Changes to this Policy
VyuMee may update this Policy when storage technologies, providers, product features or legal requirements change. The current version, effective date and canonical URL will be published here.
If VyuMee introduces a new storage purpose that requires consent, VyuMee will obtain the required choice before enabling that use rather than relying on an earlier unrelated consent.
15. Contact
VyuMee Ltd
Company number 17439372
Registered in England and Wales
Registered office: 167–169 Great Portland Street, 5th Floor, London, W1W 5PF.
Privacy and legal enquiries: legal@vyumee.co.uk
General support: support@vyumee.co.uk