Cookies and browser storage

Essential cookies support authentication, customer and administrator sessions, security, checkout returns and order access. They are used to provide requested features and cannot be switched off through Privacy choices. Blocking them in your browser may stop parts of StorieVerse from working.

Depending on the feature, these cookies may last only for the session or for a bounded period such as 12 hours for an administrator session, 15 minutes for a checkout return, or up to 30 days for an authorised order-claim journey.

First-party local storage and session storage may preserve a minimised basket, checkout recovery, selected design, temporary creative work, logout coordination and storage migration state. This supports requested journeys and recovery between pages or visits; it is not used for Analytics or Advertising.

• Temporary same-tab creative work and selected-design state: normally up to two hours.
• Basket and service-continuity state: normally up to 30 days.
• Checkout recovery and duplicate-attempt protection: normally up to 24 hours.
• Storage-policy migration state: up to 365 days.

When you save a choice, StorieVerse uses the first-party HttpOnly cookie storieverse_privacy_choice for up to 180 days. It contains a signed, opaque reference and expiry—not your selections, account information or browsing history. Minimal consent evidence is stored separately for accountability.

This cookie remembers whether the current browser accepted or rejected Analytics. Analytics collection runs only while a valid affirmative choice applies.

Google Analytics uses the first-party cookies _ga to distinguish browsers and_ga_46X2GELKGC to preserve session state. They are set only after a browser has a valid affirmative Analytics choice. This integration does not override gtag.js cookie expiry: Google documents a two-year default for each cookie, with expiry refreshed on hits by default. StorieVerse expires these known cookies when Analytics consent is withdrawn.

The Google Analytics property is configured to retain user-level and event-level data for two months. That is Google-side Analytics retention, not cookie expiry. Google’s standard aggregate reports are governed separately and are not affected by the user/event setting. Purchase measurement is separately release-gated and sends nothing while its gate is off.

Optional Google Analytics receives a public page path, sanitised page location, limited referrer and technical visit information after consent. If separately enabled, its purchase event contains only a stable order reference, GBP merchandise value, delivery amount and generic clothing item names, unit prices and quantities for a verified paid-live clothing order. It must not include names, email addresses, prompts, uploaded or generated artwork or payment-card information. Rejecting Analytics does not affect the core service, and no Google Analytics identifier, event or optional Analytics browser storage is created before affirmative consent to this current notice.

The browser hand-off used for purchase measurement is a first-party attribution record kept for at most 24 hours after the latest observed public activity and containing only pseudonymous client and session identifiers plus a controlled source class. It does not store raw campaign terms, page URLs, prompts or artwork. If a verified payment follows, an unsent server event is eligible for up to 72 hours after the payment timestamp; after that it is suppressed and its identifiers and payload are removed. Terminal operational status remains for seven days and attempt outcomes for 30 days. These periods are separate from Google’s cookie and user/event retention.

Advertising is not currently used, including Advertising tracking. There is no Advertising toggle, provider, pixel or identifier in this release. Any later provider and purpose would require updated information, separate approval and an appropriate consent choice before use.

Use Privacy choices in the footer to accept, reject or withdraw Analytics permission. Turning Analytics off takes effect immediately for future Google Analytics use, removes the known Google Analytics cookies and suppresses eligible unsent purchase events. This browser control does not itself erase Analytics data already received by Google. Any separate first-party Analytics records follow their own retention and erasure process. Consent-accountability evidence and required order, payment, tax and fulfilment records may be retained separately where required.

You can also clear cookies and site data in your browser. Doing so may sign you out, empty your basket, remove unsaved work and cause StorieVerse to ask for your choice again. Browser help pages explain how to block or remove cookies and storage.

Stripe, Supabase and hosting or security providers may use technology that is necessary for checkout, authentication, fraud prevention or secure website delivery when you use those features. Their own privacy and cookie information also applies.

Questions can be sent to support@storieverse.com.