Cookies

What we set

• pa_visitor: a random id that lets a visitor without an account have one free painting a day. It holds nothing about you. Lasts 400 days.
• session_sig: a signed token that proves the painting you just made is yours, so nobody else can open your workroom. Lasts seven days.
• session_id: the id of that painting, set beside the token so the workroom knows which painting the token is for. Lasts seven days.
• Sign-in cookies from Supabase, our account provider, when you sign in. They keep you signed in and are removed when you sign out.

What the host sets, only when it applies

• gpc_signal: set when your browser sends a Global Privacy Control signal, so every page honours it without asking again. Lasts a year.
• visitor_region: set when you arrive from the EU or EEA, so the legal notices that apply there are shown. Lasts 30 days.
• pw_attr: set when you arrive through a referral or campaign link, and only then; it remembers which link brought you so a referral discount can be honoured at checkout. It is ours, first party, never sold or shared. Lasts 90 days.

Stripe sets its own cookies on its checkout page when you pay; their policy governs those.

What we do not set

No analytics cookies, no advertising cookies, no consent banner, because there is nothing to consent to. The studio does not load Google, Meta or TikTok scripts.

Your browser’s storage

We keep one small note in your browser, the id of the last painting you made, so the wall can show it for a day. Clearing your browser’s site data removes it.

Control

Block or delete cookies in your browser at any time. Without the visitor cookie the free painting cannot be counted, so the studio will ask you to sign in; without the sign-in cookies you are signed out.