COOKIE POLICY
Effective Date: 22 April 2026
Last Updated: 10 August 2026
1. SCOPE
This Policy explains the cookies and similar browser technologies used by UME.LA on https://umela.io, the account application, and https://ume.la. It also describes third-party resources used by the web application, redirect pages, Telegram integration and checkout flow.
The Service is operated by Compit Ltd., company number 12484949, of 7 Bell Yard, London, WC2A 2JR, United Kingdom.
2. WHAT COOKIES AND SIMILAR TECHNOLOGIES ARE
Cookies are small text records stored by a browser. Local storage is a browser facility that allows a site to retain a preference on a device. Third-party scripts, images, fonts and embedded checkout pages can also cause the browser to connect to another provider and may allow that provider to store or access information under its own policy.
3. TECHNOLOGIES SET BY UME.LA
| Technology | Type | Purpose | Browser duration | Requirement |
|---|---|---|---|---|
session | Secure, HttpOnly, SameSite=Lax cookie | Maintains an authenticated or guest session across UME.LA services | Configured to persist for up to 10 years unless deleted; the corresponding server-side session expires after 30 days of inactivity | Strictly necessary |
csrf | Secure, SameSite=Lax cookie accessible to the application | Protects authentication and other requests against cross-site request forgery | Browser session | Strictly necessary for security |
theme | Local storage | Remembers the selected light, dark or system theme | Until changed by the user or browser storage is cleared | Functional appearance preference |
analytics_consent | First-party preference cookie | Remembers whether the user accepted or rejected Google Analytics | Up to 180 days | Necessary to remember the user's privacy choice |
_ga | First-party Google Analytics cookie | Distinguishes a browser using a pseudonymous identifier for statistical measurement | Up to 2 years | Analytics consent |
_ga_<container-id> | First-party Google Analytics cookie | Persists session state for the relevant Google Analytics property | Up to 2 years | Analytics consent |
The long browser expiry of the session cookie does not make the server-side login permanent. When the server-side session expires, the stored cookie can no longer restore that session and is cleared when the application detects that it is invalid.
A guest session and the session cookie may be created automatically when a person uses a feature that requires a temporary guest account, such as creating a link without first registering.
4. ANALYTICS AND ADVERTISING COOKIES
We use Google Analytics 4 to produce statistics about use of our websites and application and to improve navigation, content, reliability and performance. Google Analytics can collect page views, page and session events, referrer information, approximate location, browser and device information, timestamps, and pseudonymous client and session identifiers.
Google receives an IP address when an Analytics request is made. Google states that Google Analytics 4 uses IP information for collection and approximate geolocation but does not log or store individual IP addresses. UME.LA does not receive an IP address from Google Analytics.
We use Google Analytics only for statistical service improvement. We do not use Google Analytics User-ID, Google Signals, advertising personalisation or remarketing features, and we do not combine its pseudonymous identifier with a UME.LA account identity.
Google Analytics is separate from UME.LA Click Data. Click Data is collected on our servers when a short link is followed or scanned and is described in the Privacy Policy.
5. THIRD-PARTY RESOURCES
The Service can cause your browser to connect to the following third parties:
| Provider | When used | Information the provider may receive |
|---|---|---|
| Telegram | The Telegram login widget, Bot or Mini App is loaded or used | IP address, browser and device information, Telegram identifiers and information described in Telegram's policy |
| Google OAuth | You choose to sign in or connect an account with Google | Authentication request data and cookies or account data handled by Google |
| Google Analytics | You use our websites or application after accepting analytics cookies | Page and event data, pseudonymous identifiers, IP address during collection, approximate location, browser and device information, referrer and timestamps |
| Google Favicon service | A page displays an icon for a stored or visited destination | IP address, browser request data and the destination domain or URL included in the favicon request |
| Google Fonts | A UME.LA redirect error page loads the Inter font | IP address and browser request data |
| Creem | You open the embedded Premium checkout | IP address, browser data, checkout and payment information |
| Cloudflare | Our domains are served through Cloudflare services where enabled | IP address, request headers, security signals and cookies set by Cloudflare where necessary for its service |
Third-party cookies and similar technologies are controlled by the relevant provider. Their policies include:
- Google: https://policies.google.com/technologies/cookies
- Telegram: https://telegram.org/privacy
- Creem: https://www.creem.io/privacy
- Cloudflare: https://www.cloudflare.com/privacypolicy/
6. LEGAL BASIS AND CHOICES
The session and csrf cookies are used to provide a session requested by the user and protect the Service. They are not used for advertising. The theme value is used only to apply the appearance selected by the user and can be changed through the theme control.
We rely on the applicable exemptions from consent for strictly necessary security and authentication technologies and for a user-selected appearance preference.
Google Analytics is disabled by default and is loaded only after the user accepts analytics cookies through our consent interface. Rejecting analytics does not prevent use of the core Service.
7. MANAGING COOKIES AND STORAGE
You can:
- sign out to invalidate the current server-side session;
- change the theme using the theme control;
- accept, reject or later change the Google Analytics choice using the cookie consent interface;
- delete cookies and local storage in your browser settings;
- block or delete
_gaand_ga_<container-id>cookies; - install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout;
- block third-party cookies or requests using browser privacy controls; or
- avoid optional Google, Telegram or Creem functions if you do not want to connect to those providers.
Blocking or deleting session or csrf may prevent login, guest link creation or other protected features from working. Blocking Google Analytics does not prevent use of the core Service. Blocking Google Favicon or Google Fonts requests affects only the related icon or font display.
8. CHANGES AND CONTACT
We may update this Policy when browser storage, integrations or providers change. The latest version will be available at https://umela.io/legal/cookies.
Questions: support@umela.io