Cookie Policy

1. What this covers

Cookies are small files a site stores in your browser. Sites can also use similar technologies that work differently but do the same job, notably local storage, which keeps a value in the browser until something removes it. This policy covers both, because the Piczel client gallery uses local storage rather than cookies for almost everything it remembers.

It applies to the Piczel website, the Piczel dashboard, and the galleries and portfolio sites photographers publish with Piczel. Everything Piczel sets is first-party. Our own website and dashboard carry one analytics tool, described below; the galleries and portfolio sites photographers publish carry none. We set no advertising or cross-site tracking technology of any kind.

2. Cookies we set

All first-party, all strictly necessary. There are four:

• auth_token: keeps you signed in to the studio dashboard. Lasts 15 days.
• tenant_id: records which studio your session is currently acting for, if you belong to more than one. Lasts for the session.
• impersonated_by: set only while a member of our support team is signed in as your account to help with a problem you have raised. Lasts for the session.
• tower_token: our own internal admin console only. It is never set on a customer or visitor browser. Lasts 12 hours.

Blocking these in your browser will stop sign-in from working. There is no way to use the dashboard without them.

3. Attribution cookie

If you arrive at piczel.io through a partner link, a referral code, or a campaign link, we store where you came from so the partner is credited if you sign up:

• piczel_attr: the campaign tags from the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the partner or referral code, the page you landed on, the site that sent you, and the time. Written once, on your first tagged visit, and shared with the dashboard on the same domain. Lasts 30 days.

It holds nothing about you personally, only about the link you clicked. Blocking it is harmless: sign-up still works, and the code in the sign-up link still credits the partner.

4. Browser storage in the client gallery

A client gallery has no sign-in, so it remembers a visitor in local storage instead, separately for each collection. A visitor can clear all of it from within the gallery, or from their browser settings:

• The gallery pass: unlocks a passphrase-protected gallery on return visits, so a client is not asked every time. Kept 30 days.
• The device identifier: a random code, not a name, that ties favourites and download activity to one browser. No expiry; removed by "sign out and clear my picks".
• Visitor details: the email address, and optional name, a client has already given, so a returning visitor is not asked again. No expiry; removed when the visitor clears it.
• Basket contents: what a visitor has added from the store, so it survives a closed tab. No expiry; removed when the basket is emptied.

None of this is shared with other sites, and none of it is used to profile anyone. It is processed for the photographer, who is the controller of their own galleries, so their privacy notice applies alongside this policy.

5. Preferences on our own sites

The Piczel website and dashboard also remember your light or dark theme and the currency we detected for you, so prices are shown correctly. Losing these is harmless: the product falls back to its defaults.

6. Analytics and advertising

The Piczel website and dashboard use PostHog, a product analytics tool, to count page views, clicks, and the site that sent a visitor. It sets a first-party cookie and a local-storage key, both named ph_ followed by our project key, holding a random visitor code (not a name) and the current session. The cookie is shared across piczel.io subdomains so a visit that starts on the website and ends in the dashboard counts as one visit. Lasts one year. Session recording is switched off, and no photographs or gallery content are ever sent.

PostHog runs only on our own website and dashboard. Client galleries and portfolio sites published with Piczel carry none of it. We use no advertising network and no social-media tracker, and nothing on a Piczel page follows you to another site.

7. Things a photographer adds themselves

A photographer can connect their own tools to their portfolio site and galleries, and Piczel is not the one making that choice:

• Their own analytics, such as Google Analytics, connected to their portfolio site and galleries.
• Outside content placed on their portfolio site: a YouTube or Vimeo video, a map, or a custom embed they paste in.

Where a photographer does either, the visitor's browser contacts that company directly and that company may set its own cookies under its own policy. The photographer decides what goes on their site and is responsible for telling their visitors about it. Piczel places none of it by default.

8. Payment pages

When you pay for a Piczel subscription, our payment provider may set its own cookies on its checkout pages, under its own policy. We do not control those. Our sub-processor list names the provider.

9. Controlling all of this

You can clear or block cookies and local storage at any time in your browser settings, per site or globally, and most browsers offer a private window that discards both when you close it. In a client gallery, the "sign out and clear my picks" control removes everything the gallery has stored on that device. Blocking the strictly necessary items will prevent sign-in and password-protected galleries from working.

10. Changes to this policy

If we add a cookie, a storage key, or a third party that sets one, we will update this page and the date at the foot of it before the change takes effect.

11. Contact

Questions about cookies or tracking? Email [email protected].