Legal
Cookie policy
Cookies and similar storage used by Rosys Craft Store.
Last updated: August 27, 2026
What are cookies?
Cookies are small pieces of data stored on your device when you visit a website. We also use related technologies such as local storage and security challenge cookies. They help the Site remember your session, keep your cart, complete checkout, protect against bots, and understand how the Site is used.
This Cookie policy explains what we use on rosyscraftstore.com. It should be read with our Privacy policy.
How we use cookies
- Essential: required for sign-in, cart, checkout, security, and basic Site features.
- Preferences: remember settings such as light/dark theme.
- Analytics / performance (optional): Google Analytics and Microsoft Clarity help us understand traffic, usability, and how visitors interact with the Site. These load only if you accept optional analytics cookies.
- Security / bot protection: Cloudflare Turnstile and related Cloudflare technologies help block abuse.
- Payments: Stripe may set cookies when you use the Payment Element during checkout.
Essential first-party cookies
These cookies (or signed cookie payloads) are set by our Site to make core shopping features work. Blocking them may break sign-in, cart, or checkout.
| Name | Purpose |
|---|---|
| guest_cart_id | Identifies a guest shopping cart before you sign in or check out. |
| shop_checkout_session | Links your browser to an active checkout session and cart while you complete checkout (up to 48 hours). |
| shop_checkout_order_access | Lets you view order confirmation details tied to your payment (about 1 hour). |
| shop_checkout_validated_address | Binds your validated shipping address to locked shipping rates during checkout (about 1 hour). Cleared when you change cart items or step back within checkout. |
| shop_checkout_tax_session | Caches tax estimate results during checkout to avoid repeated calculations (up to 24 hours, limited entries). |
| shop_guest_order_access | Allows guest customers to view an order with a secure token. |
| shop_oauth_state | Short-lived OAuth state/CSRF protection during Google sign-in. |
| Supabase auth cookies (sb-*) | Keep you signed in securely via Supabase Auth. |
| theme | Remembers your light/dark theme preference. |
| store_cookie_consent | Stores your cookie preference (accept or deny optional analytics). Set when you use the cookie banner or Cookie settings. |
Local storage and similar
| Name | Purpose |
|---|---|
| rosys-craft-shop-cart-id | Client-side cart continuity (localStorage) used with our cart experience. |
| rosys-cart-merge-prompt-pending / related keys | Temporary session flags for cart merge prompts after sign-in or checkout. |
Analytics and Performance Cookies
These cookies are optional. We do not load Google Analytics or Microsoft Clarity unless you choose Accept all on the cookie banner or enable Analytics in Cookie settings. If you later opt out, we stop loading those tools on future visits (and may refresh the page to remove scripts already loaded in your current session).
When enabled, we use Google Analytics to measure Site usage (for example pages viewed and approximate traffic patterns). Google may set cookies such as _ga and related identifiers. See Google’s Privacy Policy and Google’s business privacy resources for details.
We also use Microsoft Clarity for analytics and performance insights, including heatmaps and session recordings. Clarity may drop cookies such as _clck, _clsk, MUID, SM, MR, ANONCHK, and CLID. These cookies help distinguish unique users, group page views into single sessions, identify returning visitors, and track behavioral data over time. See Microsoft’s Privacy Statement for more information.
Security, payments, and other third parties
- Cloudflare Turnstile: bot protection challenges and related cookies when forms or protected actions run.
- Stripe: payment form cookies and fraud-prevention signals during checkout.
- Google: may process data for Fonts, Places address autocomplete, Analytics, and Google sign-in.
- Microsoft: Clarity analytics cookies for heatmaps, session replay, and behavioral metrics.
- Supabase: authentication session cookies for signed-in users.
Cookie duration
Session cookies last until you close your browser. Persistent cookies remain until they expire or you delete them. Most checkout cookies expire after about 1 hour. shop_checkout_session may persist up to 48 hours while checkout is in progress. shop_checkout_tax_session entries may persist up to 24 hours. Guest cart cookies may last several days. Auth cookies last according to your session settings. The store_cookie_consent preference cookie is typically stored for about one year. Analytics cookies often persist for months unless cleared or you opt out through our cookie tools.
Checkout cookies are cleared when you complete an order, sign in or merge carts, abandon payment within checkout, or when we detect a stale payment session. The validated-address cookie is also cleared when you change items in your cart.
Managing cookies
When you first visit the Site, we show a cookie banner with equally prominent Accept all and Deny non-essential choices, plus Manage preferences to turn analytics on or off by category. Google Analytics and Microsoft Clarity load only if you choose Accept all (or enable Analytics and save). Essential cookies for cart, checkout, sign-in, and security still run either way. Closing or navigating away without choosing does not count as consent to optional analytics.
You can change your preference anytime using Cookie settings in the Site footer. Most browsers accept cookies by default. Removing essential cookies can prevent sign-in, cart persistence, or checkout from working correctly.
For general guidance, see www.allaboutcookies.org. Browser controls may not stop all third-party data collection tied to embedded payment or security tools; review those providers’ opt-out options where available.
Global Privacy Control and Do Not Track
We honor Global Privacy Control (GPC) browser signals as an opt-out of optional analytics sharing for California and other U.S. visitors where applicable. When we detect a GPC signal, we treat it like Deny non-essential: we do not load Google Analytics or Microsoft Clarity and we store a denied preference in store_cookie_consent where possible.
There is no consistent industry standard for responding to browser “Do Not Track” (DNT) signals. We do not alter our practices solely based on a DNT signal. GPC and DNT are different technologies; see also our Privacy policy.
U.S. state privacy notices
We operate a U.S.-focused storefront. Residents of California and other states with comprehensive privacy laws may have rights to know, access, correct, delete, or opt out of certain processing. We do not sell Personal Information. Optional analytics sharing with Google and Microsoft is described above and can be controlled through this Site’s cookie tools. For broader privacy rights, see our Privacy policy.
Changes
We may update this Cookie policy when our technologies or practices change. The “Last updated” date on this page will reflect the latest revision.
Contact
Questions about cookies: [email protected].