Cookie Policy

1. Summary

• One first-party cookie, shelfpics_session, keeps you signed in. It is strictly necessary.
• Your light or dark theme choice is stored in your browser and is never sent to us.
• Your browser caches the background-removal model files so the studio opens faster next time.
• No analytics, advertising, social media or tracking cookies. That is why we do not show a cookie banner.

2. What cookies and browser storage are

Cookies are small text files that a website asks your browser to keep and send back on later visits. Websites can also store data in your browser in other ways, such as localStorage and the Cache storage. Under UK and EU rules (the Privacy and Electronic Communications Regulations and the ePrivacy Directive), a site may use storage that is strictly necessary for a service you asked for without asking for consent, but needs consent for anything else, such as analytics or advertising. This policy covers all of these technologies.

3. What we use

Swipe sideways to see all columns.

4. The session cookie

When you sign up or sign in, our server sets the shelfpics_session cookie. It holds a random token that identifies your session. Our database stores only a hashed version of this token, together with its expiry date.

• HttpOnly: scripts on the page cannot read it.
• SameSite=Lax: it is not sent with requests started by other websites, which helps protect against cross-site attacks.
• Secure: on HTTPS it is only sent over encrypted connections.
• Duration: 30 days. Signing out removes it from your browser and deletes the session on our server.

It is used only to keep you signed in, show your account and credits and let the studio spend credits on your behalf. It is not used for tracking or advertising. If you block it, you can still read the website, but you will not be able to sign in or use the studio.

5. Theme preference

If you switch between light and dark mode, your browser saves your choice under the localStorage key theme. It contains only the value (for example “light” or “dark”), stays on your device and is never sent to our servers. Because it only remembers a setting you chose yourself, it does not need consent.

6. Model file cache

The studio cuts out your product in your browser with an open-source model. The first time you open the studio, your browser downloads the model weights (about 42 MB) from Hugging Face and the runtime files from the jsDelivr CDN, and keeps them in its Cache storage so they do not need to be downloaded again. These are program files, not information about you. Your photos are not stored in this cache and are never uploaded to us. You can clear the cache at any time in your browser settings; the files will simply download again next time.

7. What we do not use

• No analytics cookies or tools (such as Google Analytics).
• No advertising, retargeting or conversion cookies or pixels (such as Meta or Google Ads).
• No social media plugins that set cookies.
• No fingerprinting or cross-site tracking.

8. Why there is no cookie banner

Everything we store in your browser is either strictly necessary to provide the service you asked for or a preference you set yourself and that never leaves your device. The law does not require consent for these, so we do not show a consent banner. If we ever decide to introduce analytics, advertising or any other non-essential cookie, we will update this policy and add a consent banner first, and those cookies will only be set after you agree.

9. Third-party cookies

Some providers we work with may set their own cookies on their own pages or domains. They control these cookies under their own policies:

• Stripe: when you pay, you are taken to Stripe Checkout on Stripe’s domain. Stripe uses cookies there for payment processing and fraud prevention. See the Stripe cookie policy.
• Cloudflare: our hosting provider may set security cookies (for example to tell real visitors from bots during an attack). These are strictly necessary and are not used for tracking. See Cloudflare’s cookie policy.

Hugging Face and jsDelivr serve the model files to your browser. They see your IP address as part of the download, as described in our Privacy Policy.

10. How to control cookies

You can view and delete cookies, localStorage and cached files in your browser settings, usually under Privacy or Site data. Help pages for the most common browsers are provided by Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge. If you delete the session cookie you will be signed out. If you delete the theme setting, the site follows your device’s theme again. If you clear the cache, the model files download again the next time you open the studio.

11. Changes to this policy

We will update this policy if what we store in your browser changes. The date at the top shows the latest version. As explained in section 8, any non-essential cookie would only be added together with a consent banner.

12. Contact

Questions about cookies or browser storage? Email support@shelfpics.com (Mon to Fri, 09:00 to 17:00 UTC). See also our Privacy Policy and Security page.