Cookie and Tracking Notice
Version 2026-09-20.1 · effective September 20, 2026
This page is short because there is very little to say. That is a deliberate choice, not an oversight, and we would like to keep it that way.
lunarcanoe.com — the marketing site
This site sets no cookies. One page on it — lunarcanoe.com/films — embeds a YouTube player, and is the only place on this site where anything is loaded from a third party. That page is described below; every other page requests nothing from anyone but us.
We count visits with Umami, an analytics tool we host ourselves on our own domain: cookieless, no cross-site tracking, IP addresses are not stored, and nothing is sold or shared with anyone. It exists to tell us how many people visited a page, and that is all it can tell us.
One request does leave this site, and it goes to the application described further down this page — our own software on our own domain, never a third party. It asks one question: is this browser already signed in? If the answer is yes, a "Start free" button reads "Go to app" instead. The two are the same site, so your browser attaches the application's sign-in cookie to that request, and we answer with a single yes or no.
Nothing is stored in your browser as a result. Nothing about your visit to this site is recorded against your account — the answer is worked out without looking up who you are. And the question does not keep a sign-in alive, because reading a marketing page is not using the application. With JavaScript turned off, the button simply reads "Start free" and works exactly as it always did.
There is no tracking pixel, no advertising tag, no session recorder and no
third-party font anywhere on this site. Stylesheets, images and the analytics
script are all served from our own domain. Nothing is written to
localStorage or sessionStorage by us, on any page, including the films
page.
If you email us to ask for an invite, we have your email address because you sent it to us. That is the only thing we learn from your visit, and it happens only if you decide to do it. See section 2 of the Privacy Policy.
The site is served over HTTPS by a hosting provider that keeps ordinary server logs (an IP address, a timestamp, a URL, a user agent) for a short operational period, as any web server does. We do not build profiles from them.
The films page
lunarcanoe.com/films shows short films we made with Lunar Canoe. They are hosted on YouTube, and they are played by YouTube's own player embedded in the page. It is the only page on this site that loads anything from a third party, and we would rather say so plainly than quietly soften the sentence at the top of this page.
Opening that page requests YouTube's player, and the images it displays, from
Google. Google therefore receives your IP address, your browser's user-agent
string and the address of the page you are on — the same things it would receive if you had
opened the video on YouTube directly. We use the youtube-nocookie.com form of
the embed, which does not set Google's advertising cookies until a video is
actually played. Pressing play is what lets YouTube store things in your
browser, under its own domain and on its own terms rather than ours.
What Google does with any of that is governed by Google's privacy policy, not this one. We do not receive it back: we cannot see who watched which film, and we have deliberately not connected the embed to anything of ours. We set nothing of our own on that page.
If you would rather not load it, do not open lunarcanoe.com/films. No other page on this site embeds anything, and none of them will start doing so without this notice changing first.
The complaint form at lunarcanoe.com/report
The page you use to report content sets no cookies and runs no JavaScript, deliberately: it has to work for someone on a locked-down or hostile network, and it must not depend on anything a front-end deploy could break.
Filing a report does record two things about your connection, and neither is a cookie: a keyed one-way hash of your IP address — never the address itself — and your browser's user-agent string, truncated. They exist so that a flood of false reports can be rate-limited without letting the flood keep real victims out. Section 5 of the Privacy Policy covers what a report stores, including that a report cannot afterwards be edited or deleted.
app.lunarcanoe.com — the application
The application sets exactly one cookie, and it is the one that keeps you signed in.
| Cookie | What it is | Why |
|---|---|---|
lunarcanoe_session |
A random token. Not your email address, not your name, and nothing derived from them — the token is meaningless on its own and only identifies a row in our own session table | So that you stay signed in between page loads, and so that signing out can end that session everywhere |
It is a strictly necessary cookie: without it there is no way to be signed in at all. There is nothing to consent to and nothing to opt out of, because turning it off means not being able to use the application. It is set only when you sign in, and it is deleted when you sign out.
It carries HttpOnly (no script on the page can read it, so a bug in our own
front end cannot leak it), Secure (it is never sent over plain HTTP) and
SameSite=Lax (another site cannot make your browser act as you). It lasts 30
days from your last use, and at most 90 days however much you use it; after
that you sign in again. Signing out ends it immediately, and "sign out
everywhere" ends every session on every device.
It is not an advertising or analytics cookie, it does not follow you to any other site, and the only other place it is ever sent is the one yes/no question the marketing site asks, described above.
The application also stores exactly one thing in your browser's localStorage:
| Key | What it is | Why |
|---|---|---|
| Canvas positions | The x/y position of each scene card on your storyboard canvas, per project | So your board looks the same when you come back to it |
That is cosmetic layout state. It never leaves your browser, it is not sent to us, and it does not affect anything about your storyboard — the scene ordering in your project is the only authoritative order. Clearing your browser storage resets your card positions and nothing else.
There is no analytics in the application either — no product-analytics SDK, no session replay, no error-reporting service that would receive your content.
If this changes
The films page is the one exception to the rule this page used to state without qualification, and it is meant to stay the only one. For anything we add ourselves, the same rules hold: self-hosted, cookieless, nothing stored in your browser, no cross-site profile. If we ever do something that requires your consent, we will ask for it before setting anything, not after — and this page will change first, as it did for the films page.
Your controls
You do not need to do anything. If you want to, you can clear site data for app.lunarcanoe.com in your browser at any time; the effect is that you are signed out and your storyboard card positions reset. Signing out from inside the application does the same to the sign-in cookie, and ends the session on our side as well — which clearing your browser on its own does not.
Questions
Magic Ingredient LLC · support@enginyyr.com · Magic Ingredient LLC, 8245 E 96th St #1158, Indianapolis, IN 46256, United States
Original drafting. There was no template worth adapting for a page whose content is "we do not do this".