Cookie policy

Last updated 20 September 2026Byte Shift Ltd, company number 13244292

In short

This website sets no cookies unless you accept analytics. With your permission it uses Google Analytics, which sets two, and it asks before doing so. Refusing is one click and the site works exactly the same.
The contact form loads Cloudflare Turnstile to keep bots out, and Cloudflare may set a short lived cookie on its own domain while that check runs. It exists for the check alone and is not used for tracking.
The application sets one of its own, to keep you signed in.
Stripe, our payment processor, sets two on the billing page when you open the payment form. They exist to prevent card fraud and nothing else.
Visits are also counted in aggregate by Cloudflare Web Analytics, which sets no cookie and stores nothing on your device, so it needs no consent and cannot tell one visit from another.
No advertising, no profiling, no tracking across other sites.

This summary is here to help you read the document. Where the two differ, the document below is what applies.

1. The one thing we ask

Under the Privacy and Electronic Communications Regulations, consent is needed before storing anything on your device that is not strictly necessary to provide the service you asked for. The only such thing on this website is Google Analytics, which we use to count visits and see which pages are read, so we know what to improve. It is switched off until you say yes, and it stays off if you say no or say nothing. Nothing from Google loads on the page before that.

Advertising features are switched off on our Google Analytics property: no audiences, no remarketing, no demographic profiling. The choice you make is kept in your own browser and can be changed any time from the Cookie settings link in the footer.

2. What we do store

Name	Where	What it does	How long	Type
_ga	This website, only after you accept analytics	Set by Google Analytics to tell two visits from the same browser apart from two visitors. We use it to count visits and see which pages are read. Advertising features are switched off on our property.	2 years	Analytics, with your consent
_ga_*	This website, only after you accept analytics	Set by Google Analytics to keep the pages of one visit together as a session.	2 years	Analytics, with your consent
fs-consent	This website, in your browser storage, not a cookie	The answer you gave the cookie dialog, so we do not ask again. Never sent to us.	Until you clear your browser storage	Strictly necessary, stored locally
__Host-app_session	The application, after you sign in	A random token that identifies your signed in session. It is stored on our side as a hash, so the cookie alone tells us nothing about you.	30 days, or until you sign out	Strictly necessary
__stripe_mid	The application, on the billing page, once you open the payment form	Set by Stripe, our payment processor, to recognise a browser across payments so that stolen card details are harder to use. Stripe reads it; we never do.	1 year	Strictly necessary (fraud prevention)
__stripe_sid	The application, on the billing page, once you open the payment form	Set by Stripe for the same fraud prevention, scoped to one payment session.	30 minutes	Strictly necessary (fraud prevention)
cf_clearance and similar	On Cloudflare’s own domain, only while the contact form’s bot check runs	Set by Cloudflare Turnstile to remember that a browser passed the check. It exists for the check alone and is not used for tracking.	Short lived, set by Cloudflare	Strictly necessary (bot check)
mantine-color-scheme-value	This website and the application	Whether you chose light, dark or your system preference. Stored in your browser, never sent to us.	Until you clear your browser storage	Preference, stored locally

The session cookie is set only after you sign in. It is HTTP only, so scripts on the page cannot read it; it is restricted to the exact host that set it, so it is never sent anywhere else; and over HTTPS it is marked secure.

3. Third parties

The third party scripts, each in one place. Google Analytics loads on this website only after you accept it, and sends Google the pages you visit here, your approximate location and the kind of device you use, under Google's own privacy policy; your IP address is not stored by Google Analytics 4. Stripe's script loads only when you open the payment form on the billing page of the application, never on this website. It draws the card form inside a frame Stripe controls, so your card details go to Stripe and not to us, and it sets the two fraud prevention cookies listed above. Neither uses its cookies to track you across other sites.

One more script counts visits without identifying anyone: Cloudflare Web Analytics. It sets no cookie, uses no local storage and takes no fingerprint, which is why it runs without asking; it reports pages, referrers, countries and device types in aggregate, and cannot connect two visits or two pages to the same person. Cloudflare already carries our media and the contact form's bot check, so no new company sees anything.

Beyond that: no social widgets, no advertising pixels and no session recording. Fonts are served from our own servers rather than a font network, so loading a page does not tell anyone else that you visited.

4. Controlling what is stored

Cookie settings in the footer of this website reopens the choice; withdrawing consent removes the Google Analytics cookies straight away. You can also clear or block cookies in your browser settings. Blocking the session cookie will prevent you from signing in, because there is no other way for us to know a request is yours.

5. If this changes

If we ever add any other non essential storage, we will ask for your consent before setting it, offer refusing as easily as accepting, and update this page and our privacy policy first.

Questions: support@fashionstudioapp.com.

Questions about this document: support@fashionstudioapp.com. Byte Shift Ltd is registered in England and Wales.