Cookies and local storage
What Staffshots puts in your browser, why, and how long it stays. You can change your statistics and ad measurement choices on this page at any time.
Your choice
Ad measurement (Google Ads)
Tells us whether a visit that started from one of our ads led to a sign-up or a purchase. Google gets an order number and amount, or for a sign-up a random code we create for that sign-up and keep with your account. The code is pseudonymous, not anonymous: we can associate it with your account. Google never gets your name, email address or account number. No personalised ads and no remarketing.
Everything we store
| What it is | Kind | Set by | What it is for | How long | Consent needed |
|---|---|---|---|---|---|
| headshots.pendingOrder.<uploadId> | Session storage | Staffshots | Remembers the look and background you picked for a checked photo while you go to payment. No personal details. Cleared when you close the tab. | Until you close the tab | No, strictly necessary |
| headshots.access_token | Local storage | Staffshots | Keeps you signed in after you follow a sign-in link. | Until you sign out or clear browser data | No — strictly necessary |
| headshots.history | Local storage | Staffshots | Remembers the photos and headshot sets you made in this browser, so you can find them again. Identifiers only, no images. | Until you sign out or clear browser data | No — strictly necessary for the feature you asked for |
| headshots.consent | Local storage | Staffshots | Remembers your separate choices about statistics and ad measurement, so we stop asking. | 12 months, then we ask again | No — exempt, it is the record of your choice |
| __Host-signin_state | Cookie | Staffshots, on api.staffshots.com | Makes sure the sign-in that comes back is the one your browser started. Set only when you choose Continue with Google (or Microsoft), and deleted when sign-in finishes. | At most 10 minutes | No — strictly necessary |
| __cf_bm | Cookie | Cloudflare, our website host | Tells people from automated bots to protect the site. | 30 minutes | No — strictly necessary |
| __dpl | Cookie | Lovable, our website host | Keeps your browser on the same version of the site while we publish an update, so a page does not break halfway through loading. Holds nothing about you. | 24 hours | No — strictly necessary |
| _ga | Cookie | Tells one returning visitor apart from another. | 13 months | Yes — set only after you accept | |
| _ga_<container> | Cookie | Keeps analytics session state for this site. | 13 months | Yes — set only after you accept | |
| _gcl_au | Cookie | Links a purchase to the Google ad visit it came from | 90 days | Yes, set only after you turn on ad measurement | |
| _gcl_aw | Cookie | Remembers the ad click you arrived from, if you came from one of our ads | 90 days | Yes, set only after you turn on ad measurement | |
| headshots.returnTo | Local storage | Staffshots | Which of your sets to open after you sign in, when you followed a link to it while signed out. Holds the set's id only. | Removed when you sign in, or after 1 hour | No, strictly necessary |
| headshots.pendingEmailRefusal:<account id>:<random id> | Local storage | Staffshots | Only if saving failed: your choice to turn the emails about your previews off, one entry each time it could not be saved, for that account only, kept so this browser can save it for that account when it is signed in as that account. Never anything else. | Removed once it is saved, or after 30 days | No, strictly necessary |
Before you accept, nothing is loaded
If you have not accepted, no Google script is loaded and no request is made to Google at all — not a tag with tracking switched off, nothing. Refusing, or ignoring the banner, leaves the site exactly as it is. This applies to each choice separately: turning on statistics loads nothing for ads.
What we never send
Page addresses are sent without the query string and without the fragment, and any identifier in the path is replaced with a placeholder before sending. The sign-in and invitation pages are excluded entirely, so a sign-in link can never reach Google.
Who receives it
Google Ireland Limited is the recipient. Data may be processed by Google LLC in the United States under the EU–US Data Privacy Framework. Ad personalisation and Google signals are switched off, and the cookies expire after 13 months rather than the two-year default. If you turn on ad measurement, Google also receives, for a purchase you make, an order number, the amount and the currency, together with the ad click information stored in the cookies above. Google may process this in the United States under the EU-US Data Privacy Framework. Ad personalisation is switched off and we do not use enhanced conversions, so no email address, name or phone number is sent. Our advertising partner Ekholmen Media AB, which pays for our Google ads and holds the Google Ads account they run in, can see in that account which ads led to a purchase, with the order number, amount and currency, never who you are.
Nothing else is watching
Apart from Google Ads ad measurement, which only runs if you turn it on, we run no advertising cookies, no advertising pixel, no tag manager, no session recorder and no A/B testing tool. We do not use remarketing or personalised ads. Fonts are served from our own servers, so loading a page tells no one else that you were here.
Our guides
Our step by step guides are hosted on Notion. Nothing from Notion loads on staffshots.com. Your browser only contacts Notion if you open a guide, and Notion's own privacy and cookie policies apply there.