What the public site currently uses
The public Hub does not load an analytics provider, advertising network or behavioural-tracking script. That means there are no optional analytics or advertising cookies to accept in this version.
Essential account session cookie
When a member or staff user signs in, the server sets an emberstone_session session cookie. It is required to maintain the authenticated Emberstone account session and is configured as HttpOnly and SameSite Lax. On the production HTTPS deployment, the Secure flag should remain enabled.
Remember this device
If you deliberately select Remember this device when signing in, the site also sets an emberstone_remember cookie for up to 30 days. It contains a random selector and validator, not your password. The database stores only a one-way hash of the validator, and the token is rotated after use. You can revoke remembered access by signing out or revoking sessions from Account Security.
Public browser storage
The public site uses a small local-storage value named emberstone_privacy_notice_v1 to remember that a visitor has dismissed the privacy notice. Local storage is browser storage rather than a cookie, but it is documented here for transparency.
If analytics is added later
Optional analytics must not simply be dropped into the page without updating this system. The privacy and cookie pages should identify the provider, purpose, data involved and retention, and any consent that is required should be collected before the optional script loads.
Your controls
You can clear cookies and local storage through your browser. You can also open the panel on this site to see the categories currently in use.