Cookie Policy
Last updated: September 22, 2026
This Cookie Policy explains how Atellier (operated by Worldwide Signage Ltd. d/b/a Atellier) uses cookies, local storage, and similar technologies on our website and within the Service.
Summary
- We use browser storage to keep you signed in, keep the Service secure, and remember settings you choose.
- We do not use advertising cookies, cross-site tracking, or third-party advertising or marketing-analytics trackers, and we do not "sell" or "share" personal information under U.S. state privacy laws.
- Our web fonts are served from Atellier's own infrastructure, so loading our pages does not contact a third-party font service.
- Every item we store is listed in the table below, together with its purpose.
What Are Cookies?
Cookies are small text files placed on your device by the websites you visit. "Similar technologies" include local storage, session storage, and IndexedDB. We use the term "cookie" loosely to cover all of them. Atellier keeps your sign-in session in your browser's local storage rather than in a cookie.
What We Store
| Cookie / Storage | Party | Purpose | Duration | Basis |
|---|---|---|---|---|
sb-<project>-auth-token | First-party (local storage) | Keeps you signed in to the Atellier app and renews your session | Until you sign out or clear site data | Strictly necessary |
customer:auth-token, customerSupabaseSession, clientPortalToken, vendorPortalToken | First-party (local / session storage) | Keeps customers and vendors signed in to the customer and vendor portals | Until sign-out or cleared | Strictly necessary |
customer_portal_csrf | First-party cookie | Protects customer-portal requests against cross-site request forgery | Session | Strictly necessary |
vite-ui-theme and other UI preference keys (e.g. collapsed sidebars, calendar view, notification sounds, dismissed banners) | First-party (local storage) | Remember display choices you make in the app | Until cleared | Strictly necessary (remembers a setting you chose) |
atellier_form_session, proposal-selections:* | First-party (session storage) | Keep your progress while filling in a form or reviewing a proposal | Until the tab is closed | Strictly necessary |
| Sentry replay session (session storage) | First-party | Links an error to the short masked replay described below; signed-in app sessions only | Until the tab is closed | Strictly necessary / legitimate interests (service reliability) |
| atellier_analytics_consent | First-party (local storage) | Remember your analytics choice | Until cleared | Strictly necessary |
| atellier_marketing_anonymous_id, first/last-touch source | First-party (local storage) | Connect opted-in page and signup steps and remember campaign source; no form text | Until declined or cleared | Consent |
| Marketing site events | First-party (server) | Pseudonymous page, CTA, and signup milestone analytics | Up to 24 months | Consent |
atl_cpvariant_* | First-party cookie on customer-published pages | Shows a visitor the same version of a customer's landing page on repeat visits | 30 days | Set on behalf of the customer that published the page |
__cf_bm | Third-party (Cloudflare) | Bot and abuse protection by our network provider, where enabled | 30 minutes | Strictly necessary |
Consent
The sign-in, security, preference, and progress items above are strictly necessary to provide the Service you ask for, so they do not require consent. We do not load advertising or third-party tracking technologies.
We record marketing-site analytics only after you choose "Allow analytics." Choosing "Essential only" prevents those events and removes the marketing visitor key and stored campaign source. You can change your choice using "Analytics preferences" in the footer. Withdrawing consent does not affect processing already completed before withdrawal. We keep a minimal suppression key so app-domain milestones tied to the earlier visitor ID are ignored after withdrawal.
Error Monitoring
We use Sentry to detect errors in the Atellier app. When an error occurs during a signed-in session, a short replay of the moments before it is captured with all text and form inputs masked and images and media blocked, so we can reproduce the problem without seeing your content. Replays are not recorded on our public marketing pages. See the Privacy Policy for details.
Third Parties
- Stripe. When you pay for a subscription or pay an invoice, you complete payment on pages hosted by Stripe. Stripe sets its own cookies on those pages for payment processing and fraud prevention, as described in Stripe's cookie policy.
- Support chat widgets chosen by our customers. An organization using Atellier can choose to enable a third-party support chat widget (such as Intercom, Tawk.to, or Crisp) for its own team. When enabled, that provider may set its own cookies. The organization that enables the widget is responsible for that choice and for any notice or consent it requires.
- Optional content services. If you use the GIF picker, stock-photo search, or install and route maps, images and map tiles are loaded from GIPHY, Unsplash, or OpenStreetMap, which receive your IP address and browser information. See the Sub-Processors page.
- Pages our customers publish. Landing pages, forms, and proposals that our customers publish with Atellier may include content or embeds the customer chose to add. The customer that published the page is responsible for those.
Global Privacy Control (GPC)
We do not sell or share personal information for cross-context behavioral advertising. We honor browser-issued Global Privacy Control (GPC) signals as an opt-out of any such "sale" or "sharing" under U.S. state laws. We also stop recording marketing-site analytics when GPC or Do Not Track is enabled.
Browser Controls
- Chrome — Settings → Privacy and Security → Cookies and other site data
- Firefox — Settings → Privacy & Security → Cookies and Site Data
- Safari — Settings → Privacy → Manage Website Data
- Edge — Settings → Cookies and Site Permissions
Blocking or clearing site storage will sign you out, and blocking it entirely will prevent you from logging in to or using the Service. You can remove the marketing visitor key and stored campaign source at any time by choosing "Essential only" in Analytics preferences or by clearing site data for our website.
Changes
We may update this policy as our cookie usage evolves. The "Last updated" date reflects the most recent change.
Contact
Questions: hello@meonneon.com
Worldwide Signage Ltd. d/b/a Atellier
8405 W 54th Place
Arvada, Colorado 80002
United States