Cookie Notice
Covers: compassbystarlight.com (Compass marketing site), app.compassbystarlight.com (Compass product)
This notice explains the cookies Compass uses, what each one does, and how you can control them. Compass is provided by Starlight Tech Limited.
What a Cookie Is
A cookie is a small text file a website stores on your device. Cookies let a site keep you signed in, run security checks, and remember a few things between pages. Some cookies are essential to running a service. Others are optional and need your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).
Our Position in Short
We do not run advertising cookies, marketing cookies, or cross-site tracking cookies. We measure how the site is used with cookieless analytics, so no analytics cookie is set. The only cookies in play are the ones needed to sign you in, keep the service secure, and protect our forms from abuse. On that basis we do not show a cookie consent banner, because PECR Regulation 6(4) does not require consent for strictly necessary cookies. The one cookie that involves a third party, Google reCAPTCHA, is explained in section 3.
How We Measure Usage (Cookieless Analytics)
We use Ahrefs Web Analytics to understand how the site is used, for example which pages are visited and how people arrive. It is cookieless: it does not set a cookie, does not use a cross-site identifier, and does not build a profile of you. Because there is no cookie and no tracking identifier, there is nothing here to consent to or opt out of. Ahrefs is listed on our Sub-processor List.
1. Cookies on the Compass Marketing Site (compassbystarlight.com)
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
| `compass_marketing_csrf` | Compass | Protects the sign-up, contact, and subscribe forms from cross-site request forgery. | Strictly necessary | Session |
| `compass_marketing_route_hint` | Compass | Returns you to the page you were on if you click through to sign-up and back. | Strictly necessary | 30 minutes |
| `_GRECAPTCHA` | Set when reCAPTCHA loads on a form, to tell humans from bots. See section 3. | See section 3 | 6 months |
No cookie is set for simply browsing the marketing site. The form-protection cookies are set when you interact with a form, and the reCAPTCHA cookie when reCAPTCHA loads on those forms.
2. Cookies in the Compass Product (app.compassbystarlight.com)
You must be signed in to use the product.
| Cookie | Set by | Purpose | Type | Duration |
|---|---|---|---|---|
| `sb-access-token` | Supabase (our auth provider) | Holds your sign-in token so you stay logged in. | Strictly necessary | Session, refreshed automatically |
| `sb-refresh-token` | Supabase | Refreshes your sign-in without making you log in again. | Strictly necessary | 30 days (rolling) |
| `compass_csrf` | Compass | Protects in-product forms from cross-site request forgery. | Strictly necessary | Session |
| `compass_route_hint` | Compass | Routes you back to where you were after sign-in. | Strictly necessary | 30 minutes |
| `__stripe_mid`, `__stripe_sid` | Stripe | Fraud detection when you start or complete a subscription. | Strictly necessary | `__stripe_mid` 1 year; `__stripe_sid` 30 minutes |
| `_GRECAPTCHA` | Set when reCAPTCHA loads on sign-up, to tell humans from bots. See section 3. | See section 3 | 6 months |
The product does not set advertising, marketing, or analytics cookies. You can review your cookie position in the product at Settings, Cookies.
3. Google reCAPTCHA
We use Google reCAPTCHA v3 to protect our forms (contact, subscribe, and account sign-up) from bots and automated abuse. When reCAPTCHA loads, Google sets the `_GRECAPTCHA` cookie and receives technical information about your interaction to score whether you are likely a human. This is a fraud and security measure for forms you are actively choosing to use.
reCAPTCHA is provided by Google. Your use of it is subject to Google's Privacy Policy (https://policies.google.com/privacy) and Terms (https://policies.google.com/terms), and Google processes the data as described there.
We load reCAPTCHA only on the pages that carry those forms, not across the whole site. We treat it as necessary for the security of a service you are requesting, which is why it does not sit behind a consent banner. If you would rather not use reCAPTCHA, you can contact us by email at hello@starlighttech.ai instead of using the form. Google is listed on our Sub-processor List.
Why There Is No Consent Banner
With cookieless analytics, the usual reason for a cookie banner is gone. The remaining cookies are either strictly necessary (sign-in, security, fraud protection on payments and forms), which PECR Regulation 6(4) exempts from consent, or reCAPTCHA, which we run as a security measure on forms you choose to use and disclose in section 3. If we ever add a non-essential cookie, for example advertising or profiling analytics, we will publish a consent banner, ask before the cookie is set, and update this notice.
How to Control Cookies
You can clear or block cookies in your browser settings. If you block strictly necessary cookies, parts of Compass will not work: you will not be able to sign in, submit forms, or complete a payment.
Contact
For questions about this notice, email privacy@starlighttech.ai.
Change Log
- v1.0, 10 June 2026. First publication.
Starlight Tech Limited, company number 17175089, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered in England and Wales.