Cookies & Analytics Policy
Last updated: 26 September 2026
This policy explains the cookies and similar technologies used on shotward.com and in the Shotward workspace. We keep them to a minimum: we use strictly necessary cookies to keep you signed in, no analytics cookies, and advertising measurement cookies that are set only if you accept them.
What cookies and browser storage are
Cookies are small text files that a website stores in your browser. Similar technologies, such as local storage and session storage, let a site save information in your browser. Under the Privacy and Electronic Communications Regulations, strictly necessary cookies and storage can be used without consent; other types need your consent.
Strictly necessary cookies
These cookies are set by our authentication system when you sign in. The service cannot work without them, so they cannot be switched off. On https://shotward.com, their names begin with “__Secure-”.
| Cookie | Purpose | Duration |
|---|---|---|
| better-auth.session_token | Keeps you signed in and secures requests to your workspace | Up to 7 days, renewed while you remain active; removed when you sign out |
| better-auth.state | Protects Google sign-in against forged requests while the sign-in completes | 5 minutes |
| shotward.attribution | Carries the campaign tags on the link you arrived from (utm parameters and, unless you declined advertising cookies, TikTok’s click identifier) while a Google sign-in completes, so the new account records where it came from | 10 minutes |
Functional browser storage
Inside the workspace, we use your browser’s storage to remember choices you make. This information stays on your device and is used only to provide the feature you are using.
| Name | Type | Purpose |
|---|---|---|
| shoot-draft-v1 | Session storage | Keeps an in-progress shoot (purpose, garments and storyboard) while you move between steps; cleared when the browser tab closes or you sign out |
Product analytics
We use PostHog, through its EU-hosted service, to understand which pages are used so we can improve Shotward. We have configured it to be privacy-conscious:
- it stores nothing in your browser: no analytics cookies and no local storage, so each page visit is not linked to earlier visits;
- it records page views using the page path only, without query strings;
- automatic click and interaction tracking is switched off; and
- session recording is switched off.
Each page view includes standard technical information sent by the analytics library, such as browser, operating system, device type, screen size and referring website. PostHog may use your IP address to estimate your approximate location. We rely on our legitimate interests for this processing; you can object at any time by contacting privacy@shotward.com, or block it using a browser extension or your browser’s tracking protection.
Advertising measurement (unless you decline)
We advertise Shotward on TikTok and on Google Search. To learn whether those ads bring people here and to make them better, we use TikTok’s measurement tools and Google Ads conversion tracking. TikTok’s tools run from your first page view unless you choose “Decline” on the cookie banner; declining switches them off, removes their cookies from your browser, and the site works the same either way. You can change your choice at any time with “Cookie settings” in the footer. While they run, TikTok receives:
- Cookies: TikTok’s pixel sets the cookies below and shares them with TikTok so a visit or sign-up can be matched to an ad.
- What you do on the site: the pages you view, the content of those pages (such as page titles and product details), buttons you press, time spent and page performance (“enhanced data”).
- Details you enter, hashed: when you sign up or fill in a form, TikTok’s pixel collects the email address, name, phone number or address you typed and turns each into a one-way hash before it leaves your browser (“advanced matching”). When you create an account we also send a hashed copy of your email address, your IP address, browser type and TikTok’s click identifier from our server (“Events API”), so the sign-up is counted even if your browser blocked the pixel. The click identifier is read from the link you arrived on and stored with your account, together with the campaign tags of that link; nothing is kept in your browser for this.
| Cookie | Purpose | Duration |
|---|---|---|
| _ttp | Identifies your browser to TikTok so a visit or sign-up can be matched to an ad | 13 months |
| _tt_enable_cookie | Records that the pixel is allowed to set cookies | 13 months |
TikTok Technology Limited (Ireland) and TikTok Information Technologies UK Limited act as independent controllers for the data they receive, under their own privacy policy, and may use it to improve ad delivery generally. We rely on your agreement, given by not declining on the banner; declining stops further collection but does not undo data already sent to TikTok. We never send TikTok your unhashed email address, and none of this is used to decide what you see inside Shotward.
Google Ads conversion tracking (the “Google tag”) runs on every visit to the site, whether or not you use the banner. Google receives the pages you view, Google’s click identifier from the link you arrived on (so a visit can be matched to the ad you clicked) and, when you create an account, one “sign-up” event. It does not receive your email address or anything you type. Google Ireland Limited acts as an independent controller for this data under Google’s privacy policy.
| Cookie | Purpose | Duration |
|---|---|---|
| _gcl_au | A random id so Google can link a sign-up to an ad click | 90 days |
| _gcl_aw | Keeps Google’s click identifier (gclid) from the link you arrived on | 90 days |
| _gcl_gs | Records that a Google Ads click was seen before the tag loaded | 90 days |
| test_cookie (doubleclick.net) | Checks whether your browser accepts cookies | 15 minutes |
Error monitoring
We use Sentry to detect and fix errors. Error reports include technical details about the error and your browser. Before a report is sent, we remove request headers, cookies, request bodies and query strings. Sentry does not set cookies on our site.
Third-party sites
When you sign in with Google or pay through Stripe’s checkout and customer portal, you are taken to pages operated by those companies, which use their own cookies under their own policies.
Managing cookies
You can delete or block cookies in your browser settings. If you block strictly necessary cookies, you will not be able to sign in. Public pages of our website remain available without cookies. Your choice on the cookie banner is remembered in your browser’s local storage (“consent-v1”) so we do not ask on every visit.
Changes to this policy
If we introduce cookies or technologies that require consent, we will ask for your consent before using them and update this policy. For questions, contact privacy@shotward.com.