Cookie policy
Necessary storage supports language, privacy choices and checkout recovery. Limited first-party usage measurement has no persistent visitor identity before consent. Optional analytics can be accepted or declined without changing access to the site.
Last updated: September 23, 2026
Language preference — NEXT_LOCALE
The language-routing system can set the first-party NEXT_LOCALE cookie when a language preference needs to be remembered. It uses SameSite=Lax and has no configured persistent expiry, so it is a session cookie. Browser session-restore behaviour may keep it longer. It supports language navigation rather than advertising.
Checkout draft — cartivale.checkout.v1
The editor writes an artwork and checkout draft to sessionStorage before redirecting to Stripe. It includes the map settings, selected package, request reference and, when available, purchase reference. It is scoped to the browser tab; the reader ignores drafts older than 30 days. It is not a permanent saved project.
Stripe’s hosted page
When you follow the payment link, Stripe may use its own cookies and similar technologies for payment, security and fraud prevention. Their names and duration depend on the Stripe service and settings. Consult Stripe’s cookie information for current details; Cartivale does not load Stripe Checkout scripts on these public information pages.
Your browser controls
You can clear cookies and site storage using your browser settings. Clearing storage may reset language preferences or remove the draft used to restore the editor after Checkout. Save your downloaded files and private purchase link first.
Privacy preference — cartivale.consent.v1
Local storage remembers necessary-only or analytics-allowed, the policy version and choice time for up to 180 days. It is a preference, not a visitor identifier. A material policy change can request a fresh choice. The choice applies across languages. Reject non-essential keeps Optional analytics off; Accept enables it, subject to your browser’s privacy signal. Necessary — always on covers the required storage and limited first-party measurement explained here. Use Privacy preferences in the footer or editor to change your choice.
Limited session measurement — cartivale.analytics.session.v1
Session storage holds a random session code and limited referral context in the current browser tab. A session expires after 30 minutes of inactivity. Before optional analytics consent it does not persist across separate browser sessions. Session storage is not a cookie; browser tab/session restoration can affect its lifetime.
Optional visitor and purchase measurement
After analytics consent, cartivale.analytics.visitor.v1 in local storage holds a random visitor code for up to 180 days. cartivale.analytics.purchases.v1 stores a bounded list of non-secret transaction references for the same maximum period, to avoid repeating Google purchase events on refresh. Declining or withdrawing analytics removes these entries. Earlier pre-consent identity is not merged into this visitor code. A pending withdrawal receipt in cartivale.analytics.revocations.v1 retries removal of saved checkout identity linkage. It is deleted when acknowledged or after 90 days and is never used for browsing measurement.
Google Analytics cookies
Where configured, Google Analytics loads only after analytics consent. Its _ga and _ga_* cookies support optional measurement, with a configured lifetime of 180 days. We disable advertising signals and do not use pre-consent Google measurement pings. Cartivale-defined events use safe page paths and product categories, not private purchase links or user-entered content. Withdrawal stops future collection and removes the Google analytics cookies controlled by this site.
Cloudflare security and delivery
Cloudflare may process technical request information to secure the site, deliver public images and verify withdrawal submissions and free-export generation requests with Turnstile. This security function is separate from optional analytics. No Turnstile token is kept in analytics or correspondence records. Security cookies, where used, support the enabled Cloudflare protection services and are separate from optional analytics. The linked Cloudflare privacy and cookie information explains these technologies.