§1Categories we use
- Preferences — remembers the analytics choice you made so PicCull does not ask on every visit.
- Strictly necessary — required to sign you in, keep you signed in, accept payments, and stop automated abuse. These cannot be disabled without breaking the service.
- Analytics — product telemetry that helps us see which features people use and which screens crash. Loaded only after you give consent.
- Marketing — we do not currently set any marketing cookies. If we add them later we will refresh consent.
§2What we set today
| Name | Purpose | Category | Provider |
|---|---|---|---|
| localStorage.piccull.analyticsConsent.v1 | Remembers whether you accepted or declined optional product analytics in the PicCull app. | Preferences | PicCull |
| localStorage.accessToken | 15-minute JWT for authenticating API calls. | Strictly necessary | PicCull |
| localStorage.refreshToken | Opaque 48-byte refresh token used to mint new access tokens for 7 days. | Strictly necessary | PicCull |
| sessionStorage.sessionExpired | Flag that tells the login page to show a forced-logout banner. | Strictly necessary | PicCull |
| Payment fraud-prevention cookies | Fraud-prevention identifiers set by our payment processor at checkout. | Strictly necessary | Payment processor |
| Bot-challenge cookies | Bot challenge tokens set by our bot-challenge provider on signup and login. | Strictly necessary | Bot-mitigation provider |
| analytics_* (product analytics) | App page views, feature usage, and masked session replay. The analytics SDK and endpoints load only after consent. | Analytics | Product analytics provider |
§3Managing consent
The PicCull app keeps product analytics and masked session replay off by default. Its consent banner lets you accept or decline before the analytics SDK or endpoints load. Declining is remembered on that device. You can reset the choice by clearing PicCull site data in your browser; the app will ask again on your next visit.
The public marketing site uses aggregate, cookieless analytics with in-memory session identifiers only. It does not write an analytics cookie or analytics identifier to localStorage, and it does not run session replay. You can also block browser storage entirely, but blocking strictly necessary storage will sign you out and break checkout.
§4Do Not Track
Our analytics pipeline respects the browser’s “Do Not Track” header — when set, we do not load product analytics or any analytics cookies, regardless of in-app consent.
§5Questions
Email privacy@piccull.com if you have questions about what we store.