Cookie Policy
Which cookies UMAP360 sets, why, and how to manage them. No advertising or tracking cookies — ever.
Last updated: May 2026
Essential vs. analytics.
We use two categories of cookies — and only two. We do not use advertising, retargeting, or social-media tracking cookies.
Strictly necessary (always on)
Required for the site and dashboard to function: signing you in, keeping your session valid, remembering your consent choice. These cannot be disabled without breaking core functionality. They are first-party and do not require consent under DPDPA / GDPR / CCPA.
Analytics (opt-in)
Google Analytics, used only on umap360.com to understand aggregate visitor patterns. These cookies are blocked by default and only set if you accept on the consent banner. The dashboard does not load Google Analytics.
Every cookie we set.
The table below lists every cookie and client-side storage key UMAP360 uses, who sets it, and how long it lives. This inventory is the source of truth — if you find a cookie set by umap360.com that is not on this list, please report it to contact@umap360.com.
| Cookie / Storage | Type | Purpose | Duration |
|---|---|---|---|
| Supabase auth token | First-party, Strictly Necessary | User authentication | Session |
umap-session-start | First-party, Strictly Necessary | 24-hour session enforcement | 24 hours |
| SDK localStorage | First-party, Functional | Anonymous identity stitching | Persistent |
Google Analytics (_ga, _gid) | Third-party, Analytics | Website traffic analysis (umap360.com only) | Up to 2 years |
- We do not use advertising, retargeting, social-media, or fingerprinting cookies
- We do not sell or share data with data brokers
- We do not set cookies on behalf of third parties beyond Google Analytics (and only when you opt in)
How you control the analytics cookies.
On your first visit, our consent banner asks how you want to handle analytics cookies:
- Accept all — essential + analytics cookies are set
- Accept necessary — only essential cookies are set; analytics is blocked
- Reject all— functionally identical to “Accept necessary” (essential cookies always run; nothing else is set)
Your choice is remembered in a first-party storage key. You can change it any time — the button below clears your stored decision and re-opens the consent banner at the bottom of the page so you can pick again.
You haven’t made a consent decision yet — the banner is waiting at the bottom of any page.
Disabling cookies in your browser.
Every major browser lets you block or delete cookies for a specific site or globally. The exact steps differ; the official help pages are the canonical reference:
- Chrome · Safari · Firefox · Edge · Brave — all expose “Site settings” or “Privacy and security” panes that include cookie controls
- Mobile browsers have equivalent controls under their settings menus
- Disabling strictly necessary cookies may prevent you from signing into the UMAP360 dashboard or completing forms on umap360.com
The browser-level Do Not Track and Global Privacy Control signals are honoured automatically — see Privacy Policy §16.
Who else might set cookies.
Beyond the inventory above, third parties that we embed for specific flows may set their own cookies under their own policies:
- Razorpay — set during the dashboard checkout flow only (not on umap360.com marketing pages). Governed by Razorpay’s privacy policy.
- Vercel — our hosting provider may set short-lived cookies for edge routing and security. Governed by Vercel’s privacy policy.
When this policy changes.
We update this page whenever the cookie inventory changes (a cookie added, removed, or repurposed) or when the consent flow changes. Material changes are flagged in the Last updated date at the top of this page.