Cookie Policy

Cookies are small text files stored on your device by your web browser when you visit a website. They are widely used to make websites work efficiently and to provide information to site operators.

ColorArchive uses a minimal set of cookies, limited to what is strictly necessary for the service to function:

• Session cookie (ca_session): A single authentication cookie that keeps you logged in after signing in via magic link or Google OAuth. Type: first-party, httpOnly. Duration: 7 days. This cookie is essential for account features such as favorites sync, purchase history, and API key management.
• No tracking cookies: We do not use third-party tracking cookies, advertising cookies, or analytics cookies that identify individual users.

To be accurate rather than convenient about why: the ePrivacy Directive's Article 5(3) is technology-neutral — it covers storing or reading information in your device generally, not cookies specifically — so localStorage and sessionStorage are not exempt from it just because they are not cookies. Our position rests on the analytics storage described in section 3 being first-party, containing no personal data, setting no advertising identifier, and involving no session recording, not on a technicality about the word "cookie". If you would rather not have it, clearing site data removes all of it and the site continues to work.

In addition to cookies, ColorArchive uses your browser's localStorage to store non-sensitive preferences locally on your device:

• Favorites: Colors you mark as favorites (if not logged in, these are stored only in your browser).
• Recent colors: A list of recently viewed colors for quick access.
• UI preferences: Theme preference and other display settings.
• Pinterest token: If you connect your Pinterest account, the OAuth access token is stored in localStorage for the duration of your session.
• Analytics identifier: PostHog stores a random anonymous id here instead of setting a cookie. It is sent with product-analytics events so we can tell whether people come back, and it contains nothing about you — clearing localStorage resets it.
• First-touch source (ca_attr_v1): how you first arrived — the referring URL, the first page you landed on, any campaign parameters in the link, and the date. Stored once and kept, so that if you later subscribe or buy we can tell which channel earned it rather than crediting whatever page you happened to be on. Sent with analytics events.
• Analytics session id (ca_sid): a random per-tab id kept in sessionStorage (not localStorage), sent with analytics events so we can count *visits* instead of clicks — one person scrolling past the same card ten times should count once. It is discarded when you close the tab, is never linked to your identity, and cannot connect one visit to another.

The following third-party services may set their own cookies or collect data when you interact with them:

• Google OAuth: If you sign in with Google, Google may set cookies as part of the authentication flow. See Google's Privacy Policy.
• Vercel: Our hosting provider may collect anonymous performance metrics. See Vercel's Privacy Policy.
• Lemon Squeezy: When you are redirected to the checkout page for a purchase, our payment processor may set cookies for fraud prevention and payment processing. See Lemon Squeezy's Privacy Policy. (This entry previously named Stripe, which we no longer use.)
• PostHog: Product analytics. Configured to be cookieless — it uses the localStorage identifier described in section 3 rather than setting a cookie. See PostHog's Privacy Policy.
• Pinterest: If you use the Pinterest integration, Pinterest may set cookies during the OAuth authorization flow. See Pinterest's Privacy Policy.

You can control and manage cookies through your browser settings. Most browsers allow you to:

• View what cookies are stored and delete them individually.
• Block third-party cookies.
• Block all cookies from specific sites.
• Clear all cookies when you close the browser.

ColorArchive does not currently respond to Do Not Track (DNT) browser signals, as there is no industry-standard implementation. However, we do not engage in cross-site tracking or serve targeted advertisements, so the practical effect is the same regardless of your DNT setting.

We may update this Cookie Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. The updated policy will be posted on this page with a revised date.

If you have questions about our use of cookies, please contact us at support@colorarchive.org.