Cookie Policy

This page explains what cookies and similar technologies we use on standardblanks.com, why we use them, and how you can control them. For the broader picture of how we handle personal information, see our Privacy Policy.

What Are Cookies?

Cookies are small text files stored on your device by your browser when you visit a website. We also use related technologies such as local storage and session storage. We refer to all of these collectively as "cookies" in this policy.

Essential Cookies

These cookies are required for the site to function. Without them, you couldn't sign in, keep items in your cart, or check out securely. Examples include:

• Session cookie — keeps you signed in across page loads.
• Cart session ID — links anonymous and signed-in cart contents to your browser.
• CSRF token — protects form submissions from cross-site request forgery.

Essential cookies cannot be disabled while using the site, because the site simply won't work without them.

We also run browser error monitoring (Sentry) on every page, whether or not you accept cookies. It reports crashes and failed requests so we can fix a broken page or checkout. It sets no cookies and stores nothing on your device, and we don't use it to build a profile of you. The separate session-replay feature, which does record your session, is consent-gated — see Analytics below.

Analytics Cookies

These cookies help us understand which pages and products customers find useful, where they get stuck, and how to improve. None of them are set unless you choose "Accept" on the cookie banner. If you decline, or if you never answer the banner, we treat that as a no and none of the following runs. We use:

• PostHog (US cloud, reached through our own domain at /api/analytics) — records page views and page leaves, clicks, product views, add-to-cart, and checkout steps, plus your device and browser, referrer and campaign (UTM) parameters, and your IP address, which it uses to estimate your general location. It stores a random browser ID in a cookie and in local storage, both named ph_<project key>_posthog. When you're signed in, we link that ID to your account by an internal customer number, not your name or email, and purchases we record on our servers are tied to the same number. That is pseudonymous, not anonymous. Staff accounts are flagged and excluded from our reporting. PostHog keeps the data for its standard retention period. It isn't used to build advertising profiles. It does not record your screen or make heatmaps; we'd update this policy before turning that on.
• Internal session-tracking cookie — a 30-day sliding-window identifier we use to attribute order conversions to UTM campaigns.
• Sentry Session Replay — a masked reconstruction of what happened on the page when something goes wrong, so we can see the sequence that produced an error instead of guessing. Text is masked and images and video are blocked before anything leaves your browser. It keeps a short-lived identifier in your browser while it's running, and it doesn't load at all unless you've accepted cookies.

One thing that happens either way: our servers keep a record of the page requests they serve, including any campaign parameters in the web address, because that's how we know the site is working. When you haven't accepted cookies, those records carry a random identifier generated fresh for each request — nothing is stored on your device, and the records can't be linked to each other or back to you.

Functional Cookies

These remember your preferences — for example, dismissed banners, saved view modes, or theme choices. They aren't required, but disabling them means we won't remember those choices between visits.

Third-Party Cookies

Some pages embed third-party services which set their own cookies. These cookies are governed by those providers' own privacy policies:

• Stripe — fraud protection and payment processing at checkout.
• Google Ads — when you've accepted cookies, we read the gclid click-id from your URL after clicking an ad and store it in a first-party cookie for 90 days, and after you place an order we send the order value plus a hashed (SHA-256) version of your email and phone to Google Ads' Offline Conversions API so we can measure which ads drive sales. If you decline, the click-id is never stored and no data is sent.
• Meta (Facebook, Instagram) — when you've accepted cookies, we store the fbclid click-id the same way and after order placement send hashed email and phone via Meta's Conversions API for the same measurement purpose. If you decline, the click-id is never stored and no data is sent.

The cookie banner is the opt-out for ad-platform sharing, and it's honored twice: in your browser, where the click-id cookie is never written, and again at our server, which sends nothing to Google Ads or Meta for that order. You can change your mind later by clearing the cookie_consent cookie in your browser settings — the banner will ask again on your next visit.

Your Choices

The banner is opt-in. Until you choose "Accept," the analytics and ad-measurement cookies described above are not set — declining and ignoring the banner have the same effect. To withdraw consent later, clear the cookie_consent cookie in your browser settings and choose "Decline" when the banner asks again; PostHog stops from then on.

You can control cookies through your browser settings — most browsers let you block, delete, or be notified when cookies are being set. Note that blocking essential cookies will break sign-in, cart, and checkout.

For analytics, you can opt out of PostHog tracking by enabling "Do Not Track" in your browser; we honor that signal where technically feasible.

To unsubscribe from marketing emails (separate from cookies), use the link at the bottom of any marketing email or visit /unsubscribe.

Changes to This Policy

We may update this policy as we add or remove tools. Material changes will be noted with an updated effective date.

Contact

Questions about cookies or tracking? support@standardblanks.com.