Cookie Policy

Cookies. The digital kind.

What cookies we use, why we use them, and how to control them. Spoiler: we keep it minimal.

Last updated: September 17, 2026

1. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help the site remember things about your visit, like your login status or preferences.

We use cookies sparingly. Essential cookies keep the Service running. Optional measurement cookies only run when you allow them.

2. Cookies We Use

Essential cookies (always active)

These keep the Service running. Without them, you can't log in or use Spreadu. They can't be disabled.

  • Session cookie: Keeps you logged in while you use Spreadu. Expires when you close the browser or after the session timeout.
  • CSRF token: Protects your account from cross-site request forgery attacks.
  • Cookie consent: Remembers your cookie preferences so we don't ask every time.
  • Product analytics preference (sp_analytics_consent_v1): Carries your explicit OpenPanel choice or browser privacy signal to our signup server so it can apply that preference when creating your account. It contains no user identifier and expires 180 days after it is last synchronized. We do not create a permission cookie when you have made no choice, and this cookie does not change an existing account preference at login.

Analytics cookies (optional)

This preference controls consent-aware measurement storage for configured tags. It also controls Microsoft Clarity, which records heatmaps and session replays so we can see where our public pages confuse people.

  • Microsoft Clarity (_clck, _clsk): Runs on the homepage, marketing pages, the blog, our legal pages, and the signup flow. It never runs inside the album editor, your dashboard, the lab portal, or client proofing. Decline analytics and the script never loads at all.

Product analytics (separate preference)

Our self-hosted OpenPanel instance measures page visits, product actions, purchases and export progress to help us improve Spreadu. It is enabled by default, with a separate opt-out in account privacy settings. We respect existing explicit denials and browser Do Not Track or Global Privacy Control signals.

OpenPanel receives limited workflow statistics linked to your account ID. When you are signed in, we also send your account email in a separate profile identification request linked to that same ID. Ordinary browser and server events do not include your email.

We do not send photos, album contents, names, profile pictures or private URLs. OpenPanel session replay is off.

Advertising measurement cookies (optional)

These help us measure whether our own ads lead to registrations, checkout starts, or purchases. They only load after advertising consent.

  • Meta Pixel and Conversions API: Consent-gated browser events and matching server purchase events.
  • Google Ads: Consent Mode aware conversion tags and enhanced conversions when configured.
  • Microsoft Ads and X Ads: Consent-gated browser conversion pixels when configured.

3. What We Don't Use

For the record:

  • No advertising cookies before you allow them
  • No ad-personalization pixels without advertising consent
  • No selling your browsing data
  • No use of your photos for advertising optimization

4. Managing Your Cookies

You have full control over optional cookies:

  • In Spreadu: Toggle analytics and advertising cookies on or off from the cookie banner, footer cookie settings, or account privacy settings. These cookie choices stay on this device. The separate product analytics setting controls OpenPanel for your signed-in account.
  • In your browser: Most browsers let you block or delete cookies. Check your browser's help section for instructions.

Turning OpenPanel off stops future product analytics delivery. It does not delete events already received. You can contact us at [email protected] about deleting your data.

Keep in mind that blocking essential cookies will prevent Spreadu from working properly. You won't be able to log in or use the Service.

5. Third-Party Services

Our advertising measurement providers may set cookies or read click identifiers after advertising consent. They are used to measure our campaigns, not to use your photos or private album content for advertising.

6. Changes to This Policy

If we change the cookies we use, we'll update this page and reset your cookie preferences so you can make a fresh choice.

7. Questions?

Want to know more about how we handle cookies? We're here.