Most cookie pages describe categories. This one names every key the site can write, because there are only seven of them and you are entitled to the actual list.
The short version
We set no tracking cookies and no advertising cookies, and we run no consent banner because there is nothing to consent to. One cookie exists, and only while you are signed in. Everything else the site remembers is kept in your own browser's storage, never sent to us, and removable by you at any time.
The one cookie
| Name | When | Purpose | Lifetime |
|---|---|---|---|
tp_session |
Only after you sign in with an email link | Keeps you signed in to your account, a studio dashboard or the admin panel | Until you sign out, or the session expires |
It is HttpOnly (no script can read it), Secure (it travels only over HTTPS) and SameSite=Lax (another site cannot make your browser send it). It is strictly necessary: without it there is no way to stay signed in.
If you never sign in — and buying a single photo does not require it — the site sets no cookie at all.
What your browser keeps for itself
These are localStorage and sessionStorage keys. They live on your device, we cannot read them from our servers, and clearing your browser data removes them.
| Key | Where | Purpose | Lifetime |
|---|---|---|---|
tp:order:<id> |
localStorage | The secret token for one order, so you can reopen and download it on this device without an account. This is the only way a guest order stays yours. | Until you delete the order or clear your browser data |
tp:order:recent |
localStorage | The id of your most recent order, so the site can offer "continue your order" when you come back | 24 hours |
tp:geo |
localStorage | The country our CDN reported, cached so we do not ask again on every page, and so we can suggest the right documents | A few hours |
tp:suggest:dismissed |
localStorage | That you closed the "you seem to be in X" bar, so it does not come back | Until you clear your browser data |
tp:feedback:* |
localStorage | That you already answered "was this helpful?" on a given page, so the same question is not asked twice | Until you clear your browser data |
tp:config |
sessionStorage | A 60-second copy of the public prices and feature switches, so four parts of one page do not fetch them four times | Dies with the browser tab |
There is no language cookie
The language is in the address — /en/…, /ar/…, /tr/… — so there is nothing to store. Choosing a language from the switcher changes the URL and nothing else. Your browser's Accept-Language header is read on a first visit to redirect you once; it is not recorded.
Analytics
Product analytics run in cookieless mode: page views and a handful of product events (a document opened, a photo uploaded, a search with no results) with no cookie, no advertising identifier and nothing that lets us recognise you on another site or another day. We use it to see which pages are broken, not who you are. Blocking the analytics script changes nothing about your photo or your order.
Our error reporting sends stack traces with personal data switched off — no photos, no email addresses.
Third-party frames
Two external services can appear inside a page and set their own cookies under their own domains, never under ours:
- Paddle — the payment window at checkout. It is our seller of record, and its cookies are necessary for the payment to work.
- Cloudflare Turnstile — the privacy-preserving bot check on the upload and contact forms. It replaces a CAPTCHA and does not profile you.
Both appear only on the page that needs them, and both are governed by their own privacy policies.
How to remove everything
Clearing site data for this site in your browser removes the cookie and every key above. That also erases the tokens of any order you have not linked to an account, so download your files first. Deleting an order from its page removes the data from our servers at the same time — see the privacy policy for what that touches.
Changes
If we ever add a cookie, this table gains a row and the date at the top changes. If we ever add a cookie that is not strictly necessary, it will be behind a consent banner and off until you say yes.