Cookie Policy
Effective date: October 25, 2026
Last updated: October 25, 2026
What changed (October 25, 2026): our contact email is now [email protected]; nothing else changed.
What changed (October 21, 2026): we added our error-monitoring provider Sentry to the services your browser connects to directly; it sets no cookies (Section 5).
October 20, 2026: we corrected how long the sign-in cookie (
sb-<project>-auth-token) can stay in your browser (about 400 days, not about 1 year), and we now list more of the services your browser connects to directly (Section 5).October 18, 2026: when you buy a plan or credits, our reseller Paddle runs the checkout and may set its own cookies for payment and fraud prevention (Section 2.1).
October 13, 2026: our website analytics now also counts a few named actions, such as clicking a sign-up button; these events contain no personal details you typed.
October 13, 2026: we corrected how long the sign-in security cookie (code verifier) can stay in your browser, and noted that requesting a password reset also sets it.
October 12, 2026: we now describe the cookieless website analytics (Umami) we use, and list the short-lived
invite-codesign-up cookie.
This Cookie Policy explains how Far Star Studio Ltd. (遠星工作室有限公司) uses cookies and similar technologies on Content Forger. It should be read together with our Privacy Policy.
The short version: we use only the cookies needed to sign you in and remember your preferences. We measure page views and a few named actions with a self-hosted, cookieless analytics tool (Umami), which sets no cookies and stores nothing in your browser. When you buy a plan or credits, our reseller Paddle runs the checkout and may set its own cookies needed for payment and fraud prevention. We use no advertising cookies and no third-party tracking cookies for analytics or advertising, so we do not show a cookie consent banner.
1. What Cookies Are
Cookies are small text files that a website stores in your browser. They let the site recognize your browser across page loads and visits — for example, to keep you signed in. Similar technologies include browser local storage, which stores data in your browser without sending it to the server on every request.
2. Cookies We Set
| Name | Purpose | Type | Duration |
|---|---|---|---|
sb-<project>-auth-token (may be split into numbered parts, e.g. .0, .1) | Keeps you signed in. Set by our authentication provider (Supabase) when you log in. | Essential (first-party) | Up to about 400 days, refreshed as you use the Service |
sb-<project>-auth-token-code-verifier (may be split into numbered parts) | Temporarily holds a one-time random security value (a PKCE code verifier) used to verify a sign-in or a password-reset link. It contains no personal information. | Essential (first-party) | Set when you start a Google or GitHub sign-in or sign up, or request a password reset. Removed the next time you sign in from that browser (by any method) or sign out; otherwise it expires after about 400 days. |
language-preference | Remembers the display language you choose with the language switcher. | Functional (first-party) | 1 year |
invite-code | Temporarily remembers the invitation code you entered so it can be applied when you finish signing up. | Essential (first-party) | Up to 1 hour; removed once sign-up completes |
These are all the cookies we set ourselves. Our analytics tool sets none (see Section 4). Paddle's checkout may set its own (Section 2.1). If this changes, we will update this policy (see Section 7).
- Essential cookies are required for the Service to work — without the authentication cookies you cannot sign in or stay signed in.
- The language cookie is set when you actively choose a language, and only stores that choice.
2.1 Checkout (Paddle)
Purchases are processed by our reseller Paddle (see the Privacy Policy). Paddle's checkout script is loaded only on the pages where you can buy something. When it loads, and when you open checkout, Paddle may set cookies or use similar browser storage that it needs to process the payment and to prevent fraud. These are set and controlled by Paddle, not by us, and are described in Paddle's privacy notice. We do not use them for analytics or advertising.
3. Local Storage
We use browser local storage for one item:
| Key | Purpose |
|---|---|
theme | Remembers your light/dark theme preference. Stored only in your browser; not sent to our servers. |
Our analytics script does not write to local storage. It only reads an entry named umami.disabled; if you set it to 1 yourself, the script sends nothing from that browser (see Section 4).
4. Analytics, and What We Don't Use
We use Umami, an open-source analytics tool that we host ourselves at analytics.farstar-studio.com, to count page views and a few named actions (such as clicking a sign-up button) and understand how the website is used. It is set up without cookies:
- It sets no cookies and writes nothing to local storage or session storage.
- For each page view, your browser sends the page address (including any query string, except that invitation codes are removed and internal identifiers such as project IDs are replaced with a placeholder), the page title, the referring page (with the same parts removed), your screen size, and your browser language. Our analytics server also receives your IP address and browser user-agent as part of the request.
- For a named action, your browser also sends the action's name and where on the page it happened. It never sends your email address, anything you typed, or your content.
- The server uses your IP address and user-agent to derive your approximate location (country, region, city) and your browser, operating system, and device type, and to compute a visitor identifier that is reset every month. The analytics tool does not store your IP address (our hosting provider's standard server logs may still record it; see the Privacy Policy).
- Analytics data is not linked to your account, is not used for advertising, and is not sold.
Opting out: you can block analytics.farstar-studio.com with your browser or a content blocker, or, while on this site, run localStorage.setItem("umami.disabled", "1") in your browser's developer console (this creates a local-storage entry named umami.disabled with the value 1). The Service works the same either way.
We do not use:
- No advertising or marketing cookies
- No third-party tracking cookies for analytics or advertising, and no third-party analytics services (such as Google Analytics). Paddle's checkout cookies (Section 2.1) are used for payment and fraud prevention only.
- No email tracking pixels in the emails we send (our only emails are transactional account emails). Receipts are sent by Paddle.
- No cross-site tracking for advertising
Because we only use essential and functional cookies, our analytics is cookieless, and Paddle's checkout cookies are needed to take payment, we do not currently show a consent banner. If we ever introduce non-essential cookies (for example, cookie-based analytics or advertising), we will update this policy first and, where required by law, ask for your consent before setting them.
5. Third-Party Requests
Some requests from your browser go directly to other services:
- our storage provider (Cloudflare), when you upload or view files;
- our authentication provider (Supabase), when you sign in with Google or GitHub and when a workflow run shows its progress live;
- Google or GitHub, which serve your profile picture if you signed in with them;
- fal.ai, our image generation provider, when a generated image could not be copied to our storage and is shown from fal.ai's address;
- our error-monitoring provider (Sentry), which receives a technical error report when a page fails.
These services see standard technical data such as your IP address and browser user-agent when serving those requests (see the Privacy Policy), but they do not set tracking cookies on our site. When you open checkout, your browser also connects to Paddle (Section 2.1).
6. Managing Cookies
You can view, delete, and block cookies in your browser settings (look for "Cookies and site data" in your browser's privacy settings). Note that:
- Deleting the authentication cookie signs you out.
- Blocking cookies entirely will prevent you from signing in to the Service.
- Deleting the language cookie or
themelocal-storage entry simply resets those preferences.
7. Changes to This Policy
We will update this policy if our use of cookies or analytics changes and update the date at the top. The English version governs; translations, if provided, are for reference only.
8. Contact
Far Star Studio Ltd. (遠星工作室有限公司)
Email: [email protected]