Cookie policy
Last updated 19 September 2026
This page lists every cookie SteamKit can store on your device, what each one is for, and how long it lasts. It is the detail behind the banner you saw on your first visit.
Your choice
There are two groups below. The necessary cookies are what make signing in work, so they are always set and cannot be turned off. The analytics cookies are only ever set if you choose “Accept”, or switch analytics on yourself under “Options”.
Nothing is loaded before you answer. Until then no Google script runs on the page at all, so declining is not a matter of trusting us to stop afterwards.
You can change your mind whenever you like, and changing it back to “off” also deletes the analytics cookies already on your device: you have not answered yet — .
Strictly necessary cookies
These keep you logged in and remember your cookie choice. We do not need your permission for them, because the app cannot function without them and they are not used to track you. There are 2.
| Cookie | Set by | What it does | Kept for |
|---|---|---|---|
| sb-<project>-auth-token | Supabase (first party) | Keeps you signed in. Holds your session token, and is split across several numbered cookies when the token is too large for one. Without it every page load would ask you to log in again. | Up to 1 year, refreshed as you use the app |
| sk_consent | SteamKit (first party) | Remembers your answer to the cookie banner, so you are not asked on every page. Holds one of two values and nothing about you. | 180 days |
Analytics cookies
Set by Google Analytics 4, and only with your consent. We use them to see which features get used and where people run into trouble, so we know what to build and what to fix. There are 2.
| Cookie | Set by | What it does | Kept for |
|---|---|---|---|
| _ga | Google Analytics (third party) | Distinguishes one browser from another so repeat visits are counted as one person rather than several. | 2 years |
| _ga_<container> | Google Analytics (third party) | Keeps session state: when your visit started and whether it is still the same visit. | 2 years |
What we record
With analytics on, we collect:
- the pages you visit and in what order
- which buttons, links and tabs you click, identified by their visible label and the part of the page they sit in
- which generators you use, and the style, model and options you picked (never your prompt text, and never the images themselves)
- whether a generation succeeded or failed, and how long it took
- your plan tier, and a scrambled version of your account id so repeat visits from the same account can be counted as one person
- general technical information your browser sends anyway: device type, browser, screen size, and an approximate location no more precise than a city, worked out by Google from your IP address
What we do not record
- your email address, name or any other detail you typed in
- your prompts, or the assets you generate
- your full IP address, which Google discards before we ever see it
- anything you type into a form field
- mouse movement, keystrokes or screen recordings
The account id we send is put through a one-way scramble with a secret that never leaves our server, so Google cannot work out which SteamKit account it belongs to. We do not use these cookies for advertising, we run no ad or marketing trackers, and we do not sell anything to anyone.
Where the data goes
To Google, which processes it for us and may store it on servers outside your country, including in the United States. Google acts on our instructions under its data processing terms, and transfers rely on the European Commission’s standard contractual clauses. Google keeps the event data for 14 months, after which it is deleted automatically. Full detail is in how Google uses data from sites that use its services.
Turning cookies off in your browser
Every browser lets you block or delete cookies in its settings, and blocking analytics cookies there works just as well as declining here. Blocking the necessary ones will stop you being able to sign in, which is a limitation of how sessions work rather than a choice we made.
Changes
If we add a cookie or start using analytics for something new, we update this page and ask you again rather than relying on the answer you gave for something else. See also our privacy policy.