Last updated: May 16, 2026
We use cookies, local storage and similar device identifiers (collectively "cookies") as described below. In jurisdictions with prior-consent requirements (EU/EEA ePrivacy Directive, UK PECR, Brazil LGPD, South Africa POPIA s.69, Thailand PDPA, KSA PDPL, UAE PDPL) non-essential cookies are off until you accept them in the consent banner.
Categories
- Strictly necessary — sign-in, security, CSRF, consent. Cannot be disabled; not subject to consent.
- Functional — your preferences (language, layout, mute). Off until accepted in opt-in regions.
- Analytics — aggregated, de-identified usage events. Off until accepted in opt-in regions.
- Advertising — none today. If introduced, separate opt-in required.
Cookies we set
| Name | Category | Purpose | Lifetime | Party |
|---|---|---|---|---|
| sb-access-token | Strictly necessary | Keeps you signed in | Session / 1h refresh | First |
| sb-refresh-token | Strictly necessary | Renews your session | 30 days | First |
| csrf | Strictly necessary | Cross-site request forgery protection | Session | First |
| thumber.lang | Functional | Remembers your language | 365 days | First |
| thumber.layout | Functional | Remembers feed layout / grid choice | 365 days | First |
| thumber.mute | Functional | Remembers mute state on autoplay | 365 days | First |
| thumber.consent | Strictly necessary | Stores your cookie-consent choices | 12 months | First |
| thumber.analytics.id | Analytics (opt-in) | De-identified usage events; off in EU/UK/BR/ZA until consent | 13 months | First |
| _cf_bm | Strictly necessary | Cloudflare bot mitigation | 30 minutes | Third (Cloudflare) |
| livekit.room.token | Strictly necessary | Authenticates your livestream session | Session | Third (LiveKit) |
Withdrawing & changing consent
You can change or withdraw consent at any time in Settings → Privacy → Cookies. Withdrawal does not affect prior lawful processing. We honour the Global Privacy Control (GPC) browser signal and Do Not Track headers as valid opt-out signals where required by law (CCPA/CPRA, Colorado, Connecticut, France CNIL).
Browser & device controls
You may also clear or block cookies via your browser or OS: Chrome, Safari iOS, Firefox, Edge. Blocking strictly-necessary cookies will sign you out and break parts of the Service.
Contact
Questions: dpo@thumber.app.