Cookie Policy

This page lists every cookie BokehFrames sets. We run no advertising cookies and no cross-site tracking. We do use Google Analytics — but only if you allow it, and it is off until then.

1. Essential — required for the service to function

These are not optional; without them you cannot stay signed in or open a gallery you were sent.

• user_session — HttpOnly signed cookie that keeps you logged in. You are signed out after an hour of inactivity, and the cookie itself expires 30 days out.
• cs_<token> / sp_<token> /album_<token> — short-lived cookies remembering that you unlocked a code-gated gallery, client site or portfolio. Expire after 7 days.

2. Preferences — your UI choices

• theme — your light/dark choice.
• fotofolio.nav.pinned — collapsed or expanded sidebar.
• Other fotofolio.* localStorage entries — UI state such as last-used filters. Technically not cookies, listed for honesty.
• bf.consent.analytics — remembers whether you allowed analytics, so we stop asking. Set only once you answer.

3. Analytics — only with your consent

We use Google Analytics 4 to see which pages help people and which do not. The script is not loaded at all until you choose “Allow analytics” on the banner. Choose “No thanks” and nothing is loaded, no analytics cookies are set, and no data is sent — not even an anonymous ping.

When it is on, Google sets _ga and _ga_<id> cookies to recognise a returning browser, and we send the page you viewed, roughly where you are (city-level, from a truncated IP), and your device and browser type.

What we deliberately never send. Shared galleries, client sites, invoices, contracts, quotes, portals and questionnaires are reachable by secret link. Those links are stripped before anything reaches Google: a gallery at /s/abc123 is reported as/s/:token. Query strings are filtered to a short allowlist, so access codes and email addresses in a URL are dropped rather than transmitted. We do not send your name, your email, or the contents of any gallery.

Changing your mind. Clear the bf.consent.analytics entry in your browser's site data and the banner returns. Browser-level “Do Not Track” and cookie blocking also work normally.

4. What we don't use

• No advertising or retargeting pixels
• No Meta / Facebook Pixel
• No cross-site tracking, and no selling of data to anyone

5. Other companies involved

Analytics is one of several services we rely on to run BokehFrames. The full list — payments, email, storage, and the integrations you connect yourself — is on the third-party services page.

6. Your choices

You can block or delete cookies in your browser settings. Blocking user_session means you cannot stay signed in.

7. Contact

Questions: privacy@bokehframes.com