Cookie Policy
Last updated: 25 August 2026
This page describes cookies and similar storage used by SpotMyPixel, including ePrivacy / GDPR questions about optional affiliate attribution. Use or the footer control to change optional storage. Purchasing works if you reject optional affiliate attribution.
How we decide
Necessary / security storage is used to run the Service you request (sign-in, abuse protection, checkout hold, recording this choice). Optional affiliate attribution is not required to buy a placement. We do not use analytics or advertising-measurement categories on this site.
Whether a cookie banner is legally required depends on applicable law. Because we may serve EU users and can persist referral attribution, SpotMyPixel presents a choice for that optional storage.
First-party cookies we set
| Name | Purpose | Party | Duration | HttpOnly | Secure | SameSite | Category |
|---|---|---|---|---|---|---|---|
smp_consent | Stores whether you accepted or rejected optional affiliate attribution | First-party | About 180 days | No | Yes in production | Lax | Necessary (preference record) |
smp_ref | Remembers a validated affiliate referral code so a later purchase can be attributed | First-party | About 30 days | Yes | Yes in production | Lax | Optional affiliate attribution |
smp_affiliate_session | Keeps an affiliate signed in after a magic-link login | First-party | About 14 days | Yes | Yes in production | Lax | Necessary / security (affiliate area) |
smp_admin_session | Keeps an administrator signed in | First-party | About 7 days | Yes | Yes in production | Lax | Necessary / security (admin area) |
smp_buyer_session | Keeps a purchaser signed in after a magic-link login so they can replace artwork on their paid placements | First-party | About 7 days | Yes | Yes in production | Lax | Necessary / security (placement management) |
smp_reporter | Anonymous identifier used only to prevent the same browser from submitting duplicate reports for the same placement image revision | First-party | About 180 days | Yes | Yes in production | Lax | Necessary / security (report abuse control) |
There is no CSRF token cookie. Mutating admin, affiliate, and purchaser management requests are checked using Origin / Referer against the configured site origin.
Local and session storage
| Name | Purpose | Party | Duration | Category |
|---|---|---|---|---|
spotmypixel-theme | Remembers light, dark, or system appearance. Not used for advertising or affiliate credit | First-party localStorage | Until you clear site data | Preferences |
smp_checkout_hold | Remembers an in-progress unpaid checkout hold so the canvas can show the countdown if you return from Stripe | First-party sessionStorage | Browser tab / session | Necessary (requested checkout) |
We do not use localStorage for referral codes. A previous key referral_code is cleared if still present.
Third-party services that may set their own cookies
- Cloudflare Turnstile (script from
challenges.cloudflare.com) protects the content-check step, placement-report submissions, and admin login. Cloudflare may set cookies on its own domain. If the site is served through Cloudflare, additional host cookies (for example bot-management) may appear. Those are not set by SpotMyPixel application code. Category: security. The live production set should be confirmed on the deployed hostname. - Stripe Checkout runs on Stripe’s domain after you are redirected to pay. Stripe’s cookies are Stripe’s, not SpotMyPixel first-party cookies.
What happens if you reject optional storage
Necessary cookies still work. Theme preference still works. You can still buy a placement. We will not create or keep smp_ref. An affiliate will not receive cookie-based credit. You may still type a referral code in the checkout form if you choose to.