Motion Index — Cookie Policy
Last updated: 8 October 2026
1. Overview
Motion Index uses five cookies. All five are strictly necessary: they keep you signed in, enforce the limit on how many devices can be signed in at once, and remember whether you chose light or dark mode. We set no analytics cookies, no advertising or marketing cookies, and no tracking pixels, and we do not use a third-party analytics service of any kind.
Because everything we set is strictly necessary, there is no cookie banner and nothing to consent to. We would rather remove the thing that needs consent than ask you to click through a dialog for it.
That includes counting visitors. We do want to know roughly how many people visit the site, and the usual way to do it is to put an identifier in your browser — which is precisely the thing that would require a banner. So we don't. Visits are counted on our own server instead, using a scrambled form of your IP address and browser name that we cannot unscramble the next day. Nothing is stored on your device, and nothing about you is kept: what survives is a daily number. See section 5.
This policy names every cookie individually, with its real lifetime. Browser storage — the much larger set of keys that never leaves your device — is described by category in section 3.
2. Cookies
Every cookie below is first-party, set on motionindex.io and its subdomains,
with SameSite=Lax and the Secure flag in production.
| Cookie | Purpose | Lifetime | Readable by scripts |
|---|---|---|---|
mi_auth | Your session. This is what keeps you signed in. | 30 days | No (HttpOnly) |
mi_auth_hint | Contains only the value 1. Lets the page know a session exists so it can render the signed-in layout without waiting for a server round-trip. Never used to authenticate anything. | 30 days | Yes |
mi_did | A device identifier. See the note below. | 400 days | No (HttpOnly) |
__mi_theme | Light or dark mode, so the server can render the correct theme immediately instead of flashing the wrong one. | 1 year | Yes |
About mi_did
This one deserves a plain explanation, because it is the longest-lived thing we set and it identifies a browser rather than a session.
An account may be signed in on a limited number of devices at once. To enforce
that we need to tell one browser from another, and to still recognise this browser
after you sign out and back in — otherwise every sign-out would burn a device
slot and you would be locked out of your own account. mi_did is a random
identifier that does that, and nothing else. It is deliberately not cleared
when you sign out, for exactly that reason.
It carries no information about you, is not shared with anyone, and is not used for analytics, advertising or cross-site tracking. 400 days is the longest lifetime browsers will honour, so this is the practical maximum rather than a number we chose for its own sake.
Deleting it through your browser settings is harmless — you may just use a device slot the next time you sign in.
3. Other browser storage
Alongside cookies we use localStorage and sessionStorage. Unlike cookies,
these are not sent to our servers — they stay in your browser and are read
only by the page itself.
There are around 57 such keys, almost all of them interface preferences. Listing each one would obscure rather than inform, so they are grouped here by what they do. Anything that identifies you or your device is a cookie and is named individually in section 2 above.
Stored until you clear them (localStorage)
| Category | What it remembers |
|---|---|
| Appearance | Theme, layout density, display and sort modes |
| Search and filters | Your last search, keywords, colour/luma/saturation filter positions, active preset |
| Gallery and collections | Default collection, last collection used, similar-items preferences, frame-strip size and visibility |
| Canvas | Canvas tool settings — stroke, grid, guides, navigation mode, sidebar width |
| Recently viewed | A local list of films and frames you have opened, used for "Recently viewed" and the For You feed |
| Cached data | A temporary copy of gallery and collection responses so pages load faster |
Cleared when you close the tab (sessionStorage)
| Category | What it remembers |
|---|---|
| Session housekeeping | Whether this tab has completed start-up, scroll position per page, how many gallery items were revealed |
| Sign-in flow | An in-progress registration, a chosen billing interval carried through a Google redirect, the reason you were signed out |
| Referral source | If you arrived via a link containing a source parameter, that value is kept for the duration of the visit so we can pre-fill the "how did you hear about us" question at signup. It is discarded when the tab closes unless you complete signup. |
Clearing browser storage resets your preferences. It does not affect your account, your collections or anything you have saved.
4. Third parties
Video embeds (YouTube and Vimeo). Film pages show a preview image we host
ourselves. No connection is made to YouTube or Vimeo, and no third-party cookie
is set, until you click play. When you do, your browser connects directly to
that platform and it may set its own cookies under its own policy. We use
YouTube's privacy-enhanced mode (youtube-nocookie.com) and pass a
do-not-track signal to Vimeo, which limits what they record.
Cloudflare Turnstile. Our sign-up and sign-in forms use Turnstile to block automated abuse. It runs a check in your browser and may set its own storage to do so. This is a security measure and runs only on those forms.
Google sign-in. If you sign in with Google, Google sets cookies as part of its own authentication flow.
Stripe. If you make a payment, Stripe sets cookies for payment processing and fraud prevention.
5. What we do not use
- No Google Analytics, PostHog, or any third-party analytics service
- No advertising or marketing cookies
- No third-party tracking pixels, and nothing that reports to anyone but us
- No session recording or replay
- No cross-site tracking, and no sale or sharing of data with advertisers
We do measure how the product is used — which searches return nothing useful, which features people return to — but we do it with our own database, on our own servers, and you can turn it off. See section 6.
Counting visits
One thing we measure needs describing plainly, because it happens before you have an account and therefore before you have any settings.
Each page you open sends a short request to our own servers saying only a page was opened, and whether it was the sign-up page. It carries no identifier and nothing about who you are. To avoid counting the same person ten times in one day, the server combines your IP address and browser name with a random number that changes every 24 hours, scrambles the result, and keeps only the scrambled value. The random number is deleted when the next one is generated, which permanently destroys any way — including ours — of connecting yesterday's scrambled values back to an IP address or to each other.
What is kept afterwards is a row per day saying how many visits there were. Not who, not when within the day, not what they looked at.
Because the identifier changes daily, we cannot tell a returning visitor from a new one across days, and we have deliberately chosen not to fix that: the fix would be keeping a stable identifier, which is the thing we are avoiding.
If your browser sends Global Privacy Control, we don't count you at all. That is the objection mechanism for visits, since the Settings → Privacy toggle below needs an account and this happens before you have one.
6. Your options
Analytics. You can object to product analytics at any time in Settings → Privacy. It takes effect immediately, needs no reason, and does not degrade the Service. We also honour the Global Privacy Control signal if your browser sends one.
Cookies. The five cookies above are strictly necessary, so there is no toggle for them — blocking them means the Service cannot keep you signed in. Your browser can block or clear them at any time through its own settings.
Browser storage. Clear it from your browser settings whenever you like. It resets preferences only.
Third-party cookies. Blocking these in your browser is fine; it may stop embedded video from playing.
7. Changes
If our use of cookies changes, this page changes with it and the date at the top is updated. Material changes will be communicated through the Service or by email.
8. Contact
Questions about this policy: hello@motionindex.io
Motion Index is operated by CINESUIT AS (organisation number 931 200 909, Rådhusgata 5, 0151 Oslo, Norway). See our Privacy Policy for the full picture of what we process, on what legal basis, and your rights under the GDPR.