stagetile

Cookies

Last updated: 2026-08-07

Short version

StageTile sets four first-party functional cookies. All are strictly necessary for authentication, security, or the core experience you asked for. No tracking cookies, no advertising cookies, no cross-site cookies. No consent banner because none of these require consent.

Cookies StageTile sets

  • __Host-JSESSIONID: your sign-in session, kept server-side only (HttpOnly); 7-day maximum age, renewed on activity; cleared when you log out.
  • __Host-XSRF-TOKEN: a security token the dashboard reads to protect form submissions against cross-site request forgery; strictly necessary, not used for tracking.
  • stage-theme: stores your light or dark display preference; 1-year maximum age; no __Host- prefix because it is read by JavaScript for theme application.
  • __Host-stage-owner-slug: remembers your page address after sign-in so your own public profile page can recognise you as its owner; cleared when you log out.

All four cookies are first-party (stagetile.com only) and not shared with third parties. The __Host- prefix on three of them enforces origin-bound, path-locked behaviour at the browser level.

No tracking, no analytics cookies

StageTile uses Umami in cookieless mode for aggregate analytics. No cookies are set for analytics. No user profiles. No cross-session tracking. StageTile does not load third-party advertising scripts or tracking pixels.

Why there is no consent banner

Under the ePrivacy Directive, Article 5(3), and equivalent national laws (for example, the German TTDSG § 25), cookies that are "strictly necessary for the technical delivery of a service explicitly requested by the user" do not require consent. The session and CSRF cookies are strictly necessary for authentication and security. The theme and owner-slug cookies are strictly necessary for the dashboard experience you asked to use. StageTile still discloses all of them, and that is what this page is for.

What changes if StageTile adds a non-essential cookie

If StageTile ever introduces a cookie that is not strictly necessary — for example, a feature-flag A/B test cookie — this page will be updated and a consent flow will appear before that cookie is set. At the time of this publication, no such cookie is planned.

Questions

Contact privacy@stagetile.com.