Cookie Policy

1. What Cookies We Actually Set

This is the real, current list, not a generic description:

• Session cookies (set by Supabase Auth) — keep you signed in to your Hamia account across hamia.io and every Hamia product subdomain. Strictly necessary; the site cannot keep you signed in without them.
• hm_cookie_consent — remembers your EU/UK cookie choice (accept or necessary-only) once you make it, so you are not asked again on your next visit or on another Hamia subdomain.
• hm_ccpa_opt_out — remembers your Do Not Sell or Share preference if you are shown that control instead of the EU/UK banner.
• reCAPTCHA cookies (set by Google, when you interact with a form protected by reCAPTCHA) — help distinguish real visitors from automated abuse on sign-up, sign-in, and contact forms. Treated as strictly necessary since they protect account security directly; see section 3.

We do not currently set any analytics, advertising, or cross-site tracking cookies. No analytics or tracking script of any kind (Google Analytics, Meta Pixel, or similar) is integrated anywhere on this site today. If that ever changes, this page and the consent mechanism described below will be updated together, before any such cookie is set.

2. EU/UK Visitors: Opt-In Consent

If you visit from the EU, UK, or EEA, you see a real consent banner the first time you visit. Non-essential cookies (were we to add any) do not run until you actively accept them — strictly necessary cookies (the session cookie, and reCAPTCHA where a form needs it) run regardless, since the site cannot function without them. You can change your choice at any time using the "Cookie preferences" control shown on the page.

3. US Visitors: Do Not Sell or Share My Personal Information

If you visit from the US (or anywhere outside the EU/UK/EEA), the CCPA's own model applies: an opt-out, not a blocking consent banner. We do not currently sell or share personal information with third parties for cross-context behavioral advertising, so there is nothing to opt out of in practice today — the control below still lets you set a real, stored preference we will honor if that ever changes. If your browser sends a real Global Privacy Control signal, this preference is applied for you automatically, on every page, the moment you arrive.

4. Google reCAPTCHA

We use Google reCAPTCHA to help protect sign-up, sign-in, and contact forms from spam and abuse. Because it protects account security directly, it is treated as strictly necessary and runs regardless of your cookie preference. reCAPTCHA collects hardware and software information, such as device and application data, and sends it to Google for analysis. This is governed by Google's own Privacy Policy and Terms of Service.

5. Browser Controls

You can also control cookies directly through your browser's settings, including blocking or deleting them. Disabling the strictly necessary cookies described above will affect how the site functions, including staying signed in.

6. Changes to This Policy

If we ever add a real analytics or tracking cookie, we will update this page and the consent mechanism together, before that cookie is set, not after.

7. Contact Us

Questions about this Cookie Policy can be sent to privacy@hamia.io. See also our Privacy Policy.