Legal
Cookie Policy
Last updated: October 24, 2026
This page lists the cookies, similar technologies, and data-collection methods used by Galerist (galerist.photo and its subdomains). The Service primarily relies on strictly necessary session cookies that are exempt from consent under art. 122 of Italian Legislative Decree 196/2003 and the Italian DPA Provision of June 10, 2021. For optional features (session recording for bug-fixing, product analytics, video quality analytics) that fall within the scope of these rules, we request consent through the banner shown on your first visit.
You can withdraw or change your preferences at any time by clicking “Cookie preferences” in the footer of this page.
1. Strictly necessary cookies (always active)
These cookies are essential for the Service to function and do not require consent.
| Name | Purpose | Duration |
|---|---|---|
| sb-wqiujkihjsrdggzepyhv-auth-token (+ chunk .0, .1, …) | Photographer authentication session (Supabase JWT). Without this cookie the admin area is not accessible. | ~400 days, renewable |
| sb-wqiujkihjsrdggzepyhv-auth-token-code-verifier | PKCE verification during magic-link / OTP login flows. Temporary. | Session |
| gallery_auth_<code> | Keeps the End Client authenticated on a gallery after entering the password. | 30 days (or session if “password on every visit” is enabled) |
| gallery_email_<code> | The End Client's email address on a gallery — the one they gave at the email gate, if the photographer turned it on, or the one the photographer sent the gallery to, when they open it from the personal link in that email — so they are recognised on their next visit and find their favourites again. | 30 days |
| gallery_ticket_<code> | One-shot ticket consumed by middleware for galleries requiring a password on every visit. | Session |
| sub_gallery_auth_<code> | Authenticated access to password-protected sub-galleries. | 30 days |
| galerist-proof-session | Anonymous session UUID for the proofing system (photo selection, annotations). Identifies the client's session during review. | 90 days |
| NEXT_LOCALE | Stores the chosen language (it/en) so it does not need to be set on every visit. | 1 year |
| galerist-sidebar | Admin sidebar display preference (expanded/collapsed). | 1 year |
| galerist-tz | Your browser's time zone (e.g. Europe/Rome), so the admin area shows dates and times in your local time. | 1 year |
| galerist-consent | Stores the cookie preferences the user expressed in the banner (value: all or necessary). | 1 year |
| __cf_bm | Bot management and protection set by Cloudflare. Considered strictly necessary under the Italian DPA Provision of June 10, 2021. | 30 minutes |
2. Local storage (localStorage / sessionStorage)
These are not HTTP cookies — they are data stored locally in the browser and are never transmitted to our servers.
| Key | Storage | Content |
|---|---|---|
| galerist:billing | localStorage | Monthly/annual toggle preference on the pricing page. |
| gps_proofing_tut_overlay | localStorage | Whether the proofing welcome tutorial has already been viewed. |
| galerist-upgrade-dismissed | sessionStorage | Whether the upgrade prompt was dismissed in the current session. |
3. Monitoring cookies and technologies (consent required)
The following technologies are activated only with your explicit consent (“Accept all” in the banner).
Sentry (error monitoring + Session Replay)
We use Sentry to detect and diagnose application errors. Error tracking operates on the basis of legitimate interest (art. 6 §1 lit. f GDPR): it is essential for service security and reliability, and data is pseudonymised (sendDefaultPii: false).
Session Replay (recording user interactions to help diagnose bugs) requires your consent. When active, 10% of sessions are recorded; 100% when an error occurs. Recording is handled by scripts from Sentry Inc. (USA; EU data stored in Frankfurt). Data is transmitted to de.sentry.io via an anti-adblock proxy at galerist.photo/monitoring.
Mux Data (video quality analytics)
When videos are played via the Mux player, Mux Data collects playback quality metrics (QoE: buffering, bitrate, startup time) to improve the video experience. These metrics are transmitted to Mux Inc. servers (USA) and may include the visitor's IP address. The player is only used in galleries that contain videos uploaded via Mux. Tracking is disabled without consent. With consent, Mux Data stores a first‑party cookie named muxData (a random viewer identifier, expires after 1 year); Mux keeps the pseudonymised view data for up to 100 days.
PostHog (product analytics + session recording)
We use PostHog to understand how the site is used — which pages are viewed, what is clicked, where visitors stop — so we can fix what gets in the way. It runs only on the marketing site, on the sign‑up, login and password‑reset pages, during onboarding, in the photographer dashboard and on the plan page. It is never loaded on client galleries, on shared links or on photographers' subdomains. Without your consent the PostHog script is not loaded at all and nothing is sent to PostHog.
Session recordings reproduce the layout of the page, clicks and scrolling. Everything typed into form fields is masked, and so are email addresses; in the dashboard all text is masked and photos and videos are hidden, so a recording shows the layout and the clicks, not the content of galleries or clients' data. We do not link this data to your name or email address.
PostHog Inc. acts as our processor; data is hosted in the EU (Frankfurt, Germany) and sent to eu.i.posthog.com. PostHog stores a random identifier and the current session in your browser's storage (localStorage and sessionStorage, keys starting with ph_; no cookie). When you withdraw consent through “Cookie preferences”, collection stops and these keys are deleted.
4. Third-party cookies at checkout
When making a payment you are redirected to checkout.stripe.com or billing.stripe.com (hosted by Stripe). In that environment, Stripe sets its own technical cookies (__stripe_mid, __stripe_sid) for security and fraud prevention. These cookies are set on Stripe's domain, not on galerist.photo, and are governed by Stripe's Privacy Policy.
5. How to manage or disable cookies
Galerist preferences: click “Cookie preferences” in the footer to change or withdraw your consent at any time.
Browser settings: you can disable cookies in your browser settings. Note that without the essential cookies listed above the Service will not be usable (login, password-protected galleries, proofing).
6. Contacts and changes
For any request about cookies email privacy@galerist.photo. We will update this page whenever new cookies or new purposes are introduced. Material changes will be notified with at least 30 days' notice (by email or in-app banner) in accordance with the Terms of Service.
References: art. 122 of Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018; Italian DPA Provision of June 10, 2021 “Guidelines on cookies and other tracking tools”; Directive 2002/58/EC (ePrivacy) as amended; art. 6 §1 lit. a and f GDPR 2016/679; California Online Privacy Protection Act (CalOPPA) for California residents.