Cookie policy
One standard for every reader, in every country: nothing optional runs on your device until you say yes.
Last updated September 26, 2026
At a glance
- We use a small number of strictly necessary cookies to keep the site secure and keep you signed in.
- Preferences and analytics are optional and off until you turn them on. Our analytics are first-party, never sold and never used for advertising.
- No advertising or social-media tracking runs on The Lumen today. If that changes, we will ask you first.
- We honour Global Privacy Control signals automatically.
- You can change your mind at any time from the Cookie settings link at the bottom of every page.
What cookies are
Cookies are small text files a website stores in your browser. Similar technologies, such as local storage, session storage and cookieless measurement, work in comparable ways. In this policy we call them all “cookies”, and the same choices apply to every one of them.
First-party cookies are set by The Lumen. Third-party cookies are set by another company. We set no third-party cookies for advertising or tracking.
The cookies we use
This is the complete list. We review it whenever we add or remove a feature.
| Name | Category | Purpose | Set by | Lasts |
|---|---|---|---|---|
| sb-*-auth-token First-party cookie | Strictly necessary | Keeps you signed in and secures your account session. | The Lumen (Supabase) | Until you sign out, at most 400 days |
| lumen_consent First-party cookie | Strictly necessary | Records your cookie choices so we do not ask on every page. | The Lumen | 12 months |
| _vcrcs First-party cookie | Strictly necessary | Set only if our firewall asks your browser to pass a security check. Protects the site from automated attacks. | Vercel (our host) | 1 hour |
| meridian-theme Local storage | Preferences | Remembers the colour theme you picked. | The Lumen | Until you clear it or withdraw consent |
| lumen-vid Local storage | Analytics | A random identifier that lets us count returning readers without knowing who they are. | The Lumen | Until you clear it or withdraw consent |
| lumen-sid Session storage | Analytics | Groups page views into one visit so we can measure reading time. | The Lumen | Until you close the tab |
| Vercel Web Analytics Cookieless measurement | Analytics | Counts page views and load performance. Sets no cookies; visitors are identified by a hash that changes every day. | Vercel | No storage on your device; hash discarded after 24 hours |
Advertising. No ad partners are connected, so this category is empty. Any future partner will be listed here, and nothing will load until you opt in.
How we ask for consent
Privacy laws differ from country to country. Rather than guess where you are, we apply the strictest common standard to everyone. That means:
- Optional cookies stay off until you actively turn them on. There are no pre-ticked boxes.
- “Reject all” is as prominent as “Accept all”, and you can choose category by category.
- Scrolling or continuing to read is never treated as consent.
- Your choice lasts 12 months, after which we ask again. We also ask again if this policy changes in a meaningful way.
- We keep an anonymous record of each choice (a random identifier, the categories you allowed, the policy version, the country your request came from and the time) so we can show we respected it. We keep these records for up to three years.
Strictly necessary cookies do not need consent under any of the laws below because the site cannot work without them. We still list them so you know exactly what is on your device.
Your rights where you live
Whatever your country, you get the protections above. Depending on where you live, local law also gives you the following rights.
European Union, EEA, United Kingdom and Switzerland
GDPR, the ePrivacy Directive and national cookie rules, UK GDPR and PECR, the Swiss Federal Act on Data Protection.
Optional cookies only with your prior consent, as easy to refuse as to accept, and withdrawable at any time. You can ask to access, correct, delete, restrict or port your data, object to processing, and complain to your data protection authority.
United States
California (CCPA as amended by CPRA) and the comprehensive privacy laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, New Hampshire, Minnesota, Maryland, Tennessee and other states.
We do not sell your personal information or share it for cross-context behavioural advertising, and we do not use cookies to infer sensitive traits. We honour Global Privacy Control as a valid opt-out. You can ask to know, access, correct or delete your data, and we will not treat you differently for exercising these rights.
Canada
PIPEDA, Quebec Law 25 and provincial private-sector laws in Alberta and British Columbia.
Tracking technologies are off by default until you agree. You can withdraw consent, access and correct your data, and complain to the Office of the Privacy Commissioner or your provincial commissioner.
Latin America
Brazil (LGPD), Argentina (Law 25,326), Mexico (LFPDPPP), Colombia (Law 1581), Chile, Peru and Uruguay.
Consent is freely given, specific and revocable. You can confirm whether we process your data, access, correct, anonymise or delete it, request portability, and complain to the national authority, such as the ANPD in Brazil.
Asia-Pacific
Japan (APPI), South Korea (PIPA), China (PIPL), India (DPDP Act 2023), Singapore (PDPA), Australia (Privacy Act 1988), New Zealand (Privacy Act 2020), Thailand (PDPA), the Philippines (DPA), Indonesia (PDP Law), Vietnam and Hong Kong (PDPO).
We ask before any optional collection, tell you the purpose, and let you withdraw at any time. You can access and correct your data, request deletion, and raise concerns with your local regulator.
Middle East and Africa
United Arab Emirates (PDPL and the DIFC and ADGM regimes), Saudi Arabia (PDPL), Qatar, Bahrain, Oman, Israel, Türkiye (KVKK), South Africa (POPIA), Nigeria (NDPA), Kenya (DPA), Egypt and Morocco.
Optional cookies require your explicit consent. You can access, correct and delete your data, object to processing, withdraw consent, and complain to the competent authority, such as the Information Regulator in South Africa.
To exercise any of these rights, email privacy@thelumen.io. We reply within 30 days, or sooner where your local law requires it, and we may need to confirm your identity first. You can also appoint an authorised agent where the law allows.
Changing your choices
- On The Lumen. Use on this page or in the footer. Turning a category off stops it immediately and deletes what it stored in your browser.
- Global Privacy Control. If your browser or extension sends a GPC signal, we treat it as an opt-out of any sale or sharing of personal information and keep advertising off.
- In your browser. Every major browser lets you block or delete cookies and site data. Blocking strictly necessary cookies will stop sign-in from working.
- Do Not Track. There is no agreed standard for this older signal, so we rely on GPC and your choices here instead. Because optional tracking is off by default, the result is the same.
Where data is processed
The Lumen is hosted by Vercel and stores data with Supabase. They may process information in countries other than your own. Where the law requires it, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.
Children
The Lumen is a general news service and is not directed at children. We do not knowingly set optional cookies for anyone under the age at which they can consent where they live (13 to 16 in most countries), and we never use cookies to profile children.
Changes and contact
When we change this policy we update the date at the top. If the change affects what runs on your device, we ask for your consent again before it takes effect.
Questions or complaints: privacy@thelumen.io. You also have the right to complain to the data protection authority where you live.