Cookies and storage

Every cookie below is needed for the service to work. None is used for advertising or analytics, none is shared with a third party, and nothing follows you to another site. Under the rules that require a consent banner, strictly necessary cookies are the exception — and every one we set on these pages is.

There is one thing that is not strictly necessary, and it is not set here. It is kept on a photographer’s own website, by a line of ours they chose to add, and it is described in clause 5.

Supabase sets the cookies that keep you signed in and refresh that session. Without them, every page would ask you to sign in again. They are cleared when you sign out.

egret_guest — a random identifier, set the first time somebody favourites a photograph or leaves a comment on a gallery they opened from a link. It is what makes those come back on the next visit. It is not linked to a name or an email address, and it is not read anywhere else.

faux_g_{gallery} — for a gallery with a PIN, the PIN that was typed, for twelve hours, readable only by that one gallery’s address, so it is typed once rather than on every photograph.

egret_gs_{gallery} — for a gallery shared by invitation, a random token set once the emailed code is confirmed, for thirty days, readable only by that one gallery’s address. We keep only a one-way hash of it. “Not you?” on the gallery ends it, and so does the studio removing the invitation.

Small preferences, each holding one value and read only by the page that set it:

• egret_studio — which studio you are looking at, when you staff more than one.
• egret_sidebar — whether the navigation is expanded or collapsed.
• egret_range — the date range on the dashboard.
• egret_crew and egret_schedule_view — the filter and view on the schedule.
• egret-crm-cols-leads and egret-crm-cols-clients — which columns the CRM lists show, and in what order. Kept for a year.
• faux_page_size — how many rows a list shows. The name is a leftover from an earlier one; renaming it would quietly reset everybody’s choice.
• egret_google_state — set for a few minutes while connecting a Google Calendar, to check the reply came back from where the request went.

A studio can add a line of ours to their site so that an enquiry can be credited to the page a visitor arrived on — somebody lands on a page about one town, reads two more, and sends the form from the contact page. Where they have added it, the browser holds one entry for the length of that visit:

• egret_first_touch — the address of the first page of that site opened in this visit, the site it was reached from if any, and the campaign tags in the link followed to get there: utm_source, utm_medium, utm_campaign, utm_term, utm_content, and the click identifiers gclid, fbclid and msclkid. No other part of any address is kept.

It holds nothing that identifies anybody. It is stored for that one browser tab and deleted when the tab closes. It is read once, if and when a form on that site is submitted, so the photographer can see which page brought the enquiry in — and if no form is sent, it is never read and nothing reaches us at all. It is not read on any other website.

This one is not strictly necessary: the form works without it. It sits on the photographer’s own website rather than on ours, so it is theirs to describe in their own notice, and we tell them so where they copy the line.

Your browser can block or clear all of them. The interface preferences will simply go back to their defaults. Blocking the sign-in cookies means you cannot stay signed in, which is not something we can work around.

More about what is held and why is in the privacy notice.