EZFOTO · Trust & information
Cookie & Browser Storage Policy
Small pieces of browser data that keep your account and galleries working.
Draft updated 29 October 2026
What we use
Cookies are small values sent with web requests. Local storage stays in your browser until removed; session storage generally lasts for the tab session, although browsers may restore it. EZFOTO uses these technologies for requested features, including sign-in, gallery access, favourite selections and checkout recovery.
Account sessions
Supabase authentication uses project-specific session cookies, commonly named sb-<project-ref>-auth-token, sometimes split into chunks, and temporary authentication-flow cookies. They support sign-in, session refresh and account recovery. Their actual names and expiry depend on the deployed authentication settings. Signing out removes the active session; browser site-data controls can remove remaining entries.
Gallery preferences and access
ezfotoo_gallery_visitor_v1 identifies this browser’s favourite selections. ezfotoo_gallery_access:<workspace>:<gallery> stores a password-gallery access token. These are local-storage entries, not advertising identifiers. The stored value can remain until cleared or replaced; server-side token validity and gallery access can end earlier. Clearing site data can lose access to your previous favourites and require the password again.
Checkout recovery
Session storage holds checkout idempotency identifiers and order-access information so returning to a payment flow does not unnecessarily start another checkout. Some keys begin ezfoto:pass: or ezfoto:storage:. EZFOTO uses a single light appearance. An appearance preference saved by an older version is no longer read or updated and may be removed using your browser’s site-data controls.
Analytics, advertising and outside services
No advertising pixels or optional analytics integrations were identified in the application source reviewed for this draft. Sales Analytics in the dashboard reports order data; it is not itself a third-party tracking script. Hosting, security or payment services may use their own technologies. Provider dashboards, deployed response headers and the browser network log still need to be checked before final publication. No optional tracking is enabled by this policy page.
Your controls
You can clear or block site data in your browser, but blocking session or gallery storage can stop related features from working. An external payment page or social-media site has its own controls. We do not display an Accept all banner for optional trackers that are not installed. If optional tracking is added, we will update this notice and implement any required choice before it loads, with an accessible way to change that choice.