Legal
Cookie Policy
Last updated: 14 Oct 2026
The short version
Studio 20 does not use advertising, analytics or tracking cookies. The only cookies we set are the ones the site cannot work without — keeping you signed in and protecting our forms from abuse.
Under the Privacy and Electronic Communications Regulations (PECR), cookies that are strictly necessary to provide a service you have asked for do not need your consent. That is why you are not asked to accept cookies when you arrive: there is nothing optional to accept. If we ever add analytics or marketing tools, we will ask for your consent first and this page will change.
Cookies we set
| Name | Purpose | Expires | Type |
|---|---|---|---|
s20_session |
Keeps you signed in to your member or admin account. It holds a random token only — no personal data. | 30 days for members, 12 hours for staff accounts — or as soon as you sign out | Strictly necessary |
s20_csrf |
A security token that proves a form was submitted from our own website, blocking cross-site request forgery. | 12 hours | Strictly necessary |
Both are first-party cookies, marked HttpOnly and SameSite=Lax, and sent only over HTTPS in production. None of them is used to profile you or to track you across other websites.
Separately from cookies, your browser's session storage holds a single note, s20-seen, so the short opening animation on the homepage plays when you arrive and not every time you click back to it. It stays on your device, is never sent to us or anyone else, and disappears when you close the tab.
Third parties
YouTube (drone tour video)
The drone tour on our homepage is not loaded until you click play. Until then, nothing is requested from YouTube and no YouTube cookies are set. When you do click play, the video loads from youtube-nocookie.com in YouTube's privacy-enhanced mode, and Google may then set storage on your device and receive your IP address. That is your choice to make, which is exactly why the video waits for a click. See Google's privacy policy.
Google Maps (where to find us)
The map on our contact page works the same way as the video: nothing is requested from Google until you press Show map. Once you do, Google loads the map, may set cookies on your device and will receive your IP address. The address and a "Get directions" link are always shown as plain text, so you never have to load the map to find us.
Stripe (payments)
If you buy a membership online you are taken to Stripe's own secure checkout page to pay. Stripe sets its own cookies on its own domain for fraud prevention and to make the payment work; we do not control them and they are not set on this website. See Stripe's privacy policy.
Google Fonts
Our typefaces are served by Google Fonts. No cookies are set, but Google receives your IP address as part of the request for the font files.
Managing cookies
You can delete or block cookies in your browser settings. Because ours are strictly necessary, blocking them will stop you signing in and stop forms such as the contact form from submitting.
Contact
Questions about this policy: [email protected], or write to Studio 20, 20 High Street, Ilfracombe, Devon, EX34 9DA. See also our Privacy Policy.