Essential cookies
Essential cookies keep login, security, checkout, language, consent, anti-abuse, and owner/admin flows working. They are required for the service and cannot be disabled inside Pixilo.
Analytics cookies
Analytics cookies may load only after analytics consent. They help Pixilo understand aggregate use, route health, conversion, and product friction.
Marketing cookies
Marketing cookies may load only after separate marketing consent stored in its own versioned record. Marketing can be declined while analytics is allowed. The analytics consent record always keeps marketing set to false. When configured, advertising providers may then receive limited public-route events; private, auth, billing, owner, and operator routes remain excluded.
Owner sessions
Normal owner login uses signed HttpOnly cookies and lasts up to 72 hours. If the owner chooses Remember this device, the trusted-device session can roll for up to 7 idle days with a 30-day hard cap. Closing the browser does not necessarily sign the owner out while the cookie is valid.
No auth in localStorage
Pixilo must not store auth/session tokens in localStorage. LocalStorage may be used for non-secret display preferences such as accessibility comfort settings.
Changing preferences
The notice offers Essential only, Analytics only, Accept all optional, and separate analytics/marketing controls under Manage. Preferences can be reopened from the footer or Cookie Policy. Browser settings can also delete cookies, but deleting essential cookies may sign you out, clear a cart, or interrupt checkout.Contact:privacy@pixilo.ai
Third-party providers
Payment, email, analytics, hosting, and security providers may set their own cookies or identifiers on their own domains when you use their hosted pages or services.
Google owner authentication
When an owner chooses Continue with Google, Google Identity Services may set its own cookie or identifier and returns a signed identity assertion. Pixilo stores the stable Google subject, verified email, link state, and security audit, not the raw ID token, Google password, access token, or refresh token. This is optional essential authentication, not analytics or advertising.