Cookies & browser storage

In the European Economic Area, the United Kingdom, Switzerland and Quebec, optional measurement — including advertising — stays off until you choose to accept it; until then Google Analytics and Google Ads receive only cookieless signals, with no cookies or identifiers, which Google uses to estimate visits and purchases in aggregate. Elsewhere it is on by default, and you can turn it off at any time from Privacy settings. If your browser sends a Global Privacy Control signal, we treat it as a choice to turn optional measurement, including advertising, off wherever you are. Rejecting or turning it off leaves sign-in, your photo session and checkout available.

Essential storage

Still uses order and account session cookies to grant access to your private gallery, security controls, and cc_cookie to remember your privacy choice for up to 182 days. These are not used to measure advertising. Payment and support providers use their own operational storage when you open the requested service.

Optional measurement and referral attribution

Google Analytics uses identifiers such as _ga. PostHog uses identifiers prefixed ph_ and Still uses still.phid and still.vid in local storage. The still.via referral cookie lasts up to 60 days. These help count public-page visits, measure checkout activity and associate a sale with its referring partner.

We do not load analytics libraries or session recordings on private photo, CV or payment pages. With optional measurement enabled, the checkout reports its opening, payment-form loading, technical errors and payment progress through Still’s server. These events contain no form contents, email addresses, card details or private payment links. Only the payment provider’s verified payment notification counts as a purchase. When optional measurement is on, PostHog records interactions on public pages and produces heatmaps to help us understand where visitors encounter problems. Form inputs are masked in recordings. Automatic click capture remains disabled. A stored choice expires after 182 days; after that, optional measurement goes back to your region’s default — off in the EEA, UK, Switzerland and Quebec until you choose again, on elsewhere unless you turn it off or your browser sends Global Privacy Control.

Advertising measurement

Google Ads is a separate optional choice. In the European Economic Area, the United Kingdom, Switzerland and Quebec it sets no cookies and uses no click identifiers until you accept Advertising measurement in Privacy settings, and a purchase, or a step such as starting or signing in, made before that reaches Google Ads only as a cookieless signal; elsewhere it is on by default and turns off if you decline it there or if your browser sends a Global Privacy Control signal. When enabled, it uses advertising click identifiers and cookies such as _gcl_au and _gcl_aw (normally up to 90 days) to connect ads to completed purchases. After payment, an isolated measurement page sends the amount and currency paid and a separate transaction identifier to prevent duplicates. It does not send uploaded photographs, CV content, email addresses or private order links. Ad personalisation and enhanced conversions are disabled. Still stores a receipt marker in local storage for up to 182 days to avoid resending a purchase. OpenAI Ads (ChatGPT ads) follows the same optional choice: when enabled, we pass OpenAI the click reference it already attached to the ad's link, to connect that click to a completed sign-up or purchase; we never send OpenAI your email, name or a photograph. Meta (Facebook and Instagram ads) follows the same optional choice: when enabled, our server tells Meta when someone who came from a Meta ad signs up or completes a purchase, with the amount and currency, the click identifiers Meta set (such as _fbc and _fbp), your IP address and browser, and your email address in hashed (SHA-256) form so Meta can match the event to the ad; we never send Meta a photograph, a CV or an unhashed email. If you link a Meta ad to our Google Analytics reports, Meta may also see aggregated results from Google Analytics for its own ads. Rejecting or withdrawing advertising consent clears these identifiers and stops future advertising measurement.

Visit counter without cookies

Separately, Still’s server keeps a daily count of public page visits, the name of the website a visit came from (never the page or search terms), and how many privacy choices were made, grouped only by day and by whether the visit came from a region where measurement needs your consent first. This count sets no cookie, stores nothing in your browser and keeps no IP address, browser details or identifier of any kind, so it cannot tell who visited or recognise a return visit. It runs whatever you choose above, because there is nothing in it to consent to.

Change your choice

Open privacy settings. Turning optional measurement off stops future optional collection and removes the tracking identifiers Still can clear in this browser. It does not delete historical provider data, orders or photographs; contact foto@still.sintro.io for a data request.

Support

The help button contacts the support service only when you press it. Alternatively, email foto@still.sintro.io without opening the chat.