Cookie Policy

Authentication Cookies (Strictly Necessary)

We use a server-set HttpOnly refresh-token cookie to maintain your authentication session and provide secure access to your account. The short-lived access token used for authenticated API requests is held only in browser memory while the application is open; it is not stored in local storage or in a cookie:

• refresh_token: Stores your authentication refresh token in a server-set HttpOnly cookie to maintain your login session securely. This cookie is essential for keeping you logged in and expires after a set period for security.
• cookies_accepted: Records your cookie consent preference (true/false) to remember your choice and comply with privacy regulations.
• g_state: Google authentication state cookie used to maintain your Google sign-in session and remember your authentication preferences.

To synchronize logout between open tabs, we also store a logout-event timestamp in local browser storage. It contains no access token or refresh token.

Payment Processing Cookies (Strictly Necessary)

We use Stripe for secure payment processing. These cookies are essential for payment functionality:

• __stripe_sid: Stripe session identifier used to maintain your payment session and prevent fraud.
• __stripe_mid: Stripe machine identifier used for fraud prevention and payment security.

Google Authentication Cookies (Essential)

When you choose to sign in with Google, Google sets various cookies to manage your authentication. These cookies are essential for Google Sign-in functionality:

• __Secure-ENID, __Secure-3PSIDTS, __Secure-3PSIDCC, __Secure-3PSID, __Secure-3PAPISID: Google authentication and session management cookies for secure sign-in.
• __Secure-1PSIDTS, __Secure-1PSIDCC, __Secure-1PSID, __Secure-1PAPISID: Additional Google session cookies for maintaining authentication state.
• __Host-GAPSTS, __Host-GAPS, __Host-3PLSID, __Host-1PLSID: Google account and service-specific cookies for managing your Google account access.
• SSID, SMSV, SIDCC, SID, SEARCH_SAMESITE, SAPISID, S, NID, LSOLH, LSID, HSID, APISID, AEC, ACCOUNT_CHOOSER: Various Google service cookies for account management, search preferences, and service functionality.
• __Host-1PLSID: Additional Google account service cookie for managing your Google account access across different Google services.

reCAPTCHA Cookies (Strictly Necessary)

We use Google reCAPTCHA on account and password forms to protect the Service from spam, abuse, and automated attacks. Google may set cookies or use similar technologies for this security purpose.

Google Analytics Cookies (Optional)

If you accept analytics cookies, Google Analytics may set cookies to understand website traffic and performance:

• _ga: Used to distinguish users and measure visits.
• _ga_* (for example, _ga_YD9MHC0M9C): Used to persist session state and aggregate usage statistics.

Cloudflare Security Cookies (Strictly Necessary)

We use Cloudflare for website security and performance. These cookies are essential for protecting our website:

• __cf_bm: Cloudflare Bot Management cookie used to identify and block malicious bots while allowing legitimate traffic. This cookie is essential for website security.

Spotify Embed Cookies (Optional Feature)

If a postcard includes Spotify music or you open a Spotify preview, Spotify may set cookies or use similar technologies to provide the embedded player under its own privacy policy.