Cookie Policy
Last updated: August 14, 2026
1. Scope and definitions
This policy describes cookies and similar technologies used on rawpicker.com and api.rawpicker.com. It covers browser cookies, localStorage, pixels/tags and security tokens.
The controller is HexBit – Wojciech Osak. Contact: admin@rawpicker.com.
2. Technology categories
- Necessary: sign-in, security, recording your choice and features explicitly requested by you. They operate without additional consent.
- Preferences: language and theme stored only after the user selects them.
- Analytics: browser-side PostHog, loaded only after separate consent.
- Marketing: Google Ads and conversion measurement, loaded only after separate consent.
3. Detailed inventory
3.1. Necessary
| Name | Provider | Purpose | Duration | Storage |
|---|---|---|---|---|
| connect.sid | RawPicker / api.rawpicker.com | Maintains a secure signed-in user session. | 30 days from the last activity | HttpOnly cookie |
| desktop_callback_id | RawPicker / api.rawpicker.com | Completes Google sign-in in the desktop application. | 10 minutes | HttpOnly cookie |
| rawpicker-cookie-consent | RawPicker | Stores and demonstrates the selected cookie categories. | 180 days | localStorage |
| gallery_token_<gallery> | RawPicker | Provides access to a password-protected gallery requested by the user. | Until gallery sign-out or site data is removed | localStorage |
| Turnstile token / optionally cf_clearance | Cloudflare Turnstile | Protects forms against spam and automated abuse. | Single-use token; any security clearance lasts for the configured challenge period | browser memory / security cookie |
3.2. User-selected preferences
| Name | Provider | Purpose | Duration | Storage |
|---|---|---|---|---|
| locale | RawPicker | Remembers the language selected by the user. | Until changed or site data is removed | localStorage |
| theme | RawPicker | Remembers the selected light, dark or system theme. | Until changed or site data is removed | localStorage |
3.3. Analytics — consent required
| Name | Provider | Purpose | Duration | Storage |
|---|---|---|---|---|
| ph_<project>_posthog | PostHog (EU host) | Pseudonymous device and session identifiers and visited-path measurement. URL query parameters are not sent. | Up to 180 days | first-party cookie and localStorage |
| __ph_opt_in_out_<project> | PostHog | Communicates the consent or withdrawal decision to PostHog. | Up to 180 days | localStorage |
3.4. Marketing — consent required
| Name | Provider | Purpose | Duration | Storage |
|---|---|---|---|---|
| _gcl_* (for example _gcl_au, _gcl_aw) | Google Ads | Measures whether an ad click led to a conversion and, depending on Google settings, may personalize advertising. | 90 days | cookie / similar identifier |
| Google identifiers on provider domains (depending on configuration, for example IDE or DSID) | Advertising measurement and respecting Google account personalization settings. | In the EEA: IDE up to 13 months; DSID up to 2 weeks | third-party cookie |
4. Legal basis
Accessing or storing information on a device is governed by Articles 399–400 of the Polish Electronic Communications Law and Article 5(3) of the ePrivacy Directive. Analytics and marketing technologies rely on prior consent; where personal data is involved, Articles 6(1)(a) and 7 GDPR also apply.
Consent is not required only for transmitting a communication or for technology strictly necessary to provide a feature explicitly requested by the user. Legitimate interests do not replace consent for storing or reading optional identifiers on a device.
5. Consent and withdrawal
On the first visit, analytics and marketing tools remain blocked. You can accept or reject all or set each optional category separately. Inaction is not consent, and basic service access does not depend on analytics or marketing consent.
At any time, use the visible “Cookie settings” button or the footer link. Withdrawal is recorded immediately, first-party identifiers are removed and the page reloads to unload previously downloaded provider code. Withdrawal does not affect the lawfulness of processing before withdrawal.
6. Third-party providers
- PostHog Inc. — consent-based browser analytics and separate server-side diagnostics and pseudonymous telemetry; traffic is routed to the EU host. PostHog privacy.
- Google Ireland Limited / Google LLC — Google Ads, conversion measurement and possible personalization only after marketing consent. Google cookie information.
- Cloudflare, Inc. — Turnstile protects designated forms against abuse and is treated as a security mechanism necessary to operate the form. Cloudflare privacy.
Details about recipients, transfers and data subject rights are in the Privacy Policy.
7. Browser settings
You may also delete or block site data in browser settings. Blocking necessary cookies may prevent sign-in or access to a protected gallery. Our PostHog configuration respects Do Not Track, but the signal does not replace category choices in the consent panel.
8. Changes and contact
If purposes, providers or categories change materially, we will request fresh consent. The current version is available at rawpicker.com/cookie-policy.
Privacy questions and requests: admin@rawpicker.com.
Effective date: August 14, 2026