Cookies

Four first-party cookies, all of them analytics. Two belong to Google Analytics: _ga is set to last two years — browsers now cap that at about thirteen months — and marks your browser as one that has been here before rather than a new one, and _ga_NZ2X3YREVK, named after this site's property, holds the visit you are on now.

Two belong to Microsoft Clarity: _clck lasts a year and ties your visits together as the same returning browser, and _clsk lasts a day and joins the pages of one visit into a single replay.

One regional exception, and it is Microsoft's doing rather than ours: visitors from the European Economic Area, the United Kingdom and Switzerland get Clarity's consent mode automatically, which means it sets no cookies for them at all unless a consent signal says that it may. This site sends no such signal, so for those visitors Clarity runs without cookies and without stitching their pages into one session.

Clarity itself is loaded from clarity.ms, and Microsoft sets a handful of cookies of its own while it does: MUID and CLID on clarity.ms and bing.com, plus a few short-lived ones named MR, SM, SRM_B and ANONCHK. Those are third-party cookies, set on Microsoft's domains rather than on this one, and MUID in particular is a Microsoft-wide identifier rather than anything specific to this site. Blocking third-party cookies stops all of them and leaves the rest of the page exactly as it was.

Google Tag Manager, described on the privacy page, sets no cookies of its own. It is a container rather than a measurement tool, and an empty one writes nothing at all.

Nothing else of ours beyond those four: no advertising or tracking pixels, and no device fingerprinting. Clarity may keep a little short-lived storage of its own while it buffers what it has not yet sent.

You can check rather than take our word for it: open your browser's developer tools, look under Application or Storage, and those four are what you will find on this domain — no more than that.

Consent banners exist because sites set things before you have agreed to them. This one sets four analytics cookies and nothing else, and would rather name them plainly on this page than put a modal between you and the page you came to read.

Session replay is the part that deserves saying out loud rather than filing under analytics and hoping nobody asks. Clarity records how this site was used — scrolling, clicks, the route taken through the pages — and not who used it. There is no login here, no basket and no form, so there is nothing you could type for it to capture. It is still more than a page count, and if that is not a trade you want, the next paragraph is how to refuse it.

That is a choice, not a rule, and it is one you can override in about ten seconds. Any content blocker stops both Google Analytics and Clarity. Google publishes an opt-out extension at tools.google.com/dlpage/gaoptout. Blocking cookies for this domain in your browser settings works too. Nothing here depends on those scripts, and the site behaves identically without them.

Strictly necessary — none in use. There is no login, no basket and no form on this site that needs a session to work.

Preferences — none in use. The site does not remember choices between visits because it does not ask you to make any; the language switch is two separate addresses rather than a stored setting.

Analytics — in use, and the only category that is. Google Analytics 4 and Microsoft Clarity as described above, plus Cloudflare's own analytics, which sets no cookies. Between them they tell us which pages get read, roughly which country from, how those pages were actually used, and how quickly the site loaded.

Marketing — none in use, and none planned.

This page is the record, and it is meant to stay ahead of the site rather than behind it. If anything else is added — a booking form, an embedded map, another measurement tool — it gets named here, with what it sets and how long it lasts, before it is switched on.

That used to be guaranteed by the way the site is built rather than by anybody's good intentions: nothing could reach this page except through a change to the code, and a change to the code is where this page gets edited. Google Tag Manager loosens that, because a tag can now be turned on from a dashboard without the code being touched at all. So this is a promise rather than a mechanism, and it is one worth holding us to. If you ever find something in your browser's developer tools that is not named on this page, that is our mistake and not your misreading, and the address at the bottom of this page will get it fixed.

Sites we build for clients sometimes do need cookies, usually for a booking or ordering system. Where that is the case, your site gets its own cookie notice covering exactly what it sets, rather than a copy of this one.

Four load on this site: Google Analytics and Google Tag Manager, both from googletagmanager.com; Microsoft Clarity, from clarity.ms; and Cloudflare's analytics beacon, from static.cloudflareinsights.com. All four are described above, and all four can be blocked without breaking anything.

Links out to WhatsApp and Instagram are ordinary links — following one takes you to that company, where their own policies apply, but nothing is shared with them until you do.

Questions about any of this go to hello@theaurenstudio.com and get a reply from a person, not a ticket queue.