Last updated: November 15, 2026
Website: passportcraft.com
Operator: PassportCraft LLC, 418 Broadway, Ste N, Albany, NY 12207, USA
Contact: privacy@passportcraft.com
1. What Are Cookies
Cookies are small text files that websites place on your device (computer, tablet, or phone) when you visit them. They help the website remember your preferences and understand how you interact with the site. Some cookies are deleted when you close your browser (session cookies); others remain on your device for a set period (persistent cookies).
We also use similar technologies such as local storage and pixel tags, which function in comparable ways. When we refer to "cookies" in this policy, we include all such technologies.
2. How We Use Cookies
We use a minimal set of cookies to operate our website and understand how visitors use it. Our cookies fall into the following categories:
Strictly Necessary Cookies
These cookies are essential for the website to function. They enable core features such as language preferences, navigation, and security. You cannot opt out of these cookies because the website cannot operate properly without them.
Analytics Cookies
These cookies help us understand how visitors interact with our website by collecting pseudonymized usage data that we analyze in aggregate. We use this information to improve our content and user experience. Analytics cookies are set only with your consent. For visitors in the EEA, UK, and Switzerland, we do not place analytics cookies until you accept them via our consent banner; in other regions, analytics is enabled by default and you may opt out at any time. You can change your choice or withdraw consent at any time through the cookie settings link in our footer.
Functional Cookies
These cookies remember choices you make (such as your preferred language) to provide a more personalized experience. Some functional cookies overlap with strictly necessary cookies when the functionality is essential to site operation. In the application, functional entries remember a choice you made, such as a closed notice or a layout. They are set only when you make that choice. The cookie banner does not turn them off; clearing your browser storage removes them.
Google Sign-in Prompt
On some pages we offer a prompt to create an account or sign in with Google. It uses a few entries of its own, including one cookie that Google's script sets. They are listed in their own table in Section 3, and the cookie banner does not turn them off.
Note: PassportCraft does not currently use any marketing, advertising, or social media tracking cookies.
3. Cookie Inventory
Some entries below use your browser's local storage or session storage instead of a cookie. The Purpose column says so. Session storage belongs to one browser tab and lasts until the browser ends that tab's session. A name written with <...> contains an identifier, such as the ID of a passport.
Strictly Necessary Cookies
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
NEXT_LOCALE | passportcraft.com | Remembers the language the website shows you | First-party | Session, or 1 year once you choose a language or are sent to one | Necessary |
suggested_locale | passportcraft.com | Stores a locale suggestion based on your geographic location | First-party | 1 day | Necessary |
geo_locale_dismissed | passportcraft.com | Records that you dismissed the locale suggestion banner | First-party | 30 days | Necessary |
pc_email_confirm | passportcraft.com | Holds the one-time confirmation token from your sign-up email between opening its link and pressing "Confirm my email" | First-party | 1 hour, or until you press the button | Necessary |
pc_analytics_consent | passportcraft.com | Stores your cookie consent preference (via browser local storage) | First-party | Persistent (no fixed expiry; stored until you change it or clear your browser storage — see Section 4) | Necessary |
pc_page_check_result | passportcraft.com | Keeps your latest product page check result in this browser tab, so it survives a refresh (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
pc-lang-dismissed:<passport id> | passportcraft.com | Records that you closed the language suggestion on a public passport page (via browser session storage; see Section 8) | First-party | Until the browser ends the tab's session | Necessary |
Google Sign-in Prompt
On some pages we offer a prompt to create an account or sign in with Google. The prompt is offered whatever you chose in the cookie banner, and it uses these entries (see Section 6):
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
pc_one_tap_nonce_<id> | passportcraft.com | A one-time security value that ties a Google sign-in prompt to your browser | First-party | 10 minutes | Sign-in prompt |
pc_one_tap_session_v1 | passportcraft.com | Records that the Google sign-in prompt was offered in this tab, or that it should stay hidden here, for example after you close it, sign out or use another way to sign in (via browser session storage) | First-party | Until the browser ends the tab's session | Sign-in prompt |
g_state | Google (accounts.google.com), set on passportcraft.com | Decides when Google shows its sign-in prompt again; it also holds a browsing-session identifier and Google's own test settings (see Section 6) | First-party | 180 days | Sign-in prompt |
Analytics Cookies
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
_ga | Google (analytics.google.com) | Distinguishes unique visitors for analytics | First-party | 2 years | Analytics |
_ga_0QFWJ9W821 | Google (analytics.google.com) | Maintains session state for Google Analytics | First-party | 2 years | Analytics |
pc_one_tap_source_v1 | passportcraft.com | Records which kind of page offered the Google sign-in prompt, to count sign-ups by page (via browser session storage) | First-party | Until the browser ends the tab's session | Analytics |
Note on duration vs. data retention. The "2 years" shown above is the browser-side expiry of the analytics identifier cookie — the period after which your browser deletes the cookie if you do not return. It is distinct from how long the underlying analytics data is retained: as explained in our Privacy Policy, Google Analytics event data is retained for 14 months from collection (our configured Google Analytics 4 retention setting), after which Google deletes it automatically. In other words, the cookie identifies your browser for up to 2 years, but the analytics data associated with it is deleted after 14 months.
Application Cookies (Signed-in Users)
When you create an account and sign in, the application uses the following cookies and browser storage:
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
sb-<project>-auth-token | Supabase (supabase.com) | Authentication session for signed-in users | First-party | Up to 400 days; removed when you sign out | Necessary |
sb-<project>-auth-token-code-verifier | Supabase (supabase.com) | A one-time security value kept while you sign in with Google or Microsoft, confirm your email address or reset your password | First-party | Up to 400 days; replaced or removed when that step finishes | Necessary |
pc:fresh-passport | passportcraft.com | Tells the editor that you just created this passport, so it opens at the first empty field; removed once read (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
pc:datasheet-attach-failed | passportcraft.com | Tells the editor that a datasheet you chose could not be attached; removed once read (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
passportcraft:client-draft:v2:<user id>:<partner id> | passportcraft.com | Keeps the client details a partner typed while they add a payment method; ignored after 30 minutes (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
passportcraft:submitted-client-creation:v1:<user id>:<partner id> | passportcraft.com | Keeps a reference to a client account a partner submitted, with the client's name and plan, so reloading the page cannot pay for it twice (via browser local storage) | First-party | Until the request finishes, or until you clear your browser storage | Necessary |
partner-request:v1:<ids> | passportcraft.com | Records that you closed a partner's request notice in this tab; the request itself stays open (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
supplier-request-expansion:<ids> | passportcraft.com | Keeps your place on the Suppliers page and on a passport's supplier requests while you move around the application in this tab: which suppliers and requests are open, and where you were on the page when you followed a link (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
supplier-request-pages:<workspace id>:<supplier id> | passportcraft.com | Keeps the number of pages of a supplier's requests you loaded, so the list keeps its length when you come back in this tab. When you show only one request status, the name of that status is added to the entry's name (via browser session storage) | First-party | Until the browser ends the tab's session | Necessary |
__stripe_mid | Stripe (stripe.com), set on passportcraft.com | Helps Stripe prevent fraud by assessing the risk of a payment attempt. Stripe's script sets it as soon as our payment page loads, and only there | First-party | 1 year | Necessary |
__stripe_sid | Stripe (stripe.com), set on passportcraft.com | Helps Stripe prevent fraud by assessing the risk of a payment attempt. Stripe's script sets it as soon as our payment page loads, and only there | First-party | 30 minutes | Necessary |
pc_setup_checklist_dismissed | passportcraft.com | Records that you closed the setup checklist on your dashboard | First-party | 1 year | Functional |
pc_dashboard_intro_v1.<user id>.<workspace id> | passportcraft.com | Records that you closed the dashboard introduction | First-party | 1 year | Functional |
sidebar-collapsed | passportcraft.com | Remembers whether you collapsed the side menu (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
pc_playground_nav_closed | passportcraft.com | Records that you closed the Playground section of the side menu in a partner account | First-party | 1 year | Functional |
pc_passports_view | passportcraft.com | Remembers whether you view your passports as a list or a grid (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
pc:passport-editor-mode | passportcraft.com | Remembers which editor layout you chose (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
trial-banner-dismissed-band | passportcraft.com | Records that you closed the trial notice, so it returns only when its urgency changes (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
limit-banner-dismissed-band | passportcraft.com | Records that you closed the notice about your publishing limit, so it returns only when its urgency changes (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
drafts-ready-dismissed:<limit> | passportcraft.com | Records that you closed the notice about drafts you can now publish, until your plan's limit changes again (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
sidebar-promotion:assistant-drafting:v1:<user id> | passportcraft.com | Records that you closed the side-menu suggestion to draft passports with an AI assistant (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
pc:cell-datasheet-tip:<passport id> | passportcraft.com | Records that you closed a tip on the datasheet review screen (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
pc-partner-hide-amounts | passportcraft.com | Remembers whether a partner chose to hide amounts on screen (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
passportcraft:ended-clients:v1:<user id>:<partner id> | passportcraft.com | Remembers which ended client arrangements a partner hid from their list (via browser local storage) | First-party | Persistent (until you clear your browser storage) | Functional |
supplier-request-status:<workspace id> | passportcraft.com | Remembers which request status you chose to show on the Suppliers page (via browser session storage) | First-party | Until the browser ends the tab's session | Functional |
4. Consent
We use a cookie consent banner that appears when you first visit our website. The banner presents "Accept" and "Decline" options with equal prominence, with nothing pre-selected. Through it you can:
- Accept analytics cookies
- Decline analytics cookies
- Change your preferences at any time via the cookie settings link in our footer
How consent works by region. For visitors in the EEA, UK, and Switzerland, analytics cookies are not placed until you actively accept them (prior opt-in). For visitors elsewhere, analytics is enabled by default and you may opt out at any time. The banner cannot turn off strictly necessary cookies, which the website needs to work. It also cannot turn off the functional entries in Section 3, which remember a choice you made, or the entries of the Google sign-in prompt (Section 3). Nor can it turn off the cookies of Stripe's payment form on our payment page (Section 6).
We also honor the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals: if your browser sends either, we treat it as a refusal of analytics cookies regardless of region. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
How your choice is stored. When you accept or decline analytics cookies, we save your choice as a single value (granted or denied) in your browser's local storage under the name pc_analytics_consent. This choice is stored only in your browser; it does not currently include a timestamp, version, or server-side log. Because it is held in your browser, your choice persists until you change it through the cookie settings link in our footer or clear your browser's storage. We do not currently set a fixed expiry that automatically re-prompts you after a set period. When a change needs a consent you have not given, we will ask for it (see Section 9). If you use a different browser or device, or clear your storage, you will be asked again.
More information about your rights. Analytics cookies may involve the processing of personal data. For a full description of how we handle personal data — including your rights of access, rectification, erasure, objection, and the right to lodge a complaint with a supervisory authority, as well as details of our EU/UK representative (DataRep) — please see our Privacy Policy.
5. How to Manage Cookies
In addition to our consent banner, you can control cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored on your device
- Delete individual or all cookies
- Block cookies from specific or all websites
- Set preferences for first-party vs. third-party cookies
Here are links to cookie management instructions for common browsers:
Please note: Blocking strictly necessary cookies may impair the functionality of our website, such as language selection and navigation.
6. Third-Party Cookies
Google Analytics
We use Google Analytics for website analytics. Google Analytics processes data on our behalf to help us understand visitor behavior (pages viewed, time on site, navigation paths).
- Provider: Google LLC, Mountain View, CA, USA
- Data processed: Page views, session data, device type, browser type, approximate location (country/region level)
- Cookie type: First-party (set under our domain)
- Transfers: Data is transferred to the United States. Google participates in the EU-US Data Privacy Framework. See their privacy policy for details.
- Opt-out: You can opt out via our cookie consent banner or by using browser cookie settings. You can also install Google's Google Analytics Opt-out Browser Add-on (available for Chrome, Firefox, Safari, and Edge), or read more about how Google uses information from sites or apps that use its services.
Stripe
You pay on our payment page or on Stripe's own checkout and billing pages. Our payment page runs Stripe's payment form. Stripe's script sets the Stripe cookies listed in Section 3 on passportcraft.com, for payment security and fraud prevention. On our payment page, Stripe's payment form also sets cookies on Stripe's domains and on the domain of hCaptcha, the bot check that Stripe uses. If you use Link, Stripe's service that saves your payment details, Link sets cookies on Stripe's domains that keep you signed in to Link. Stripe's payment form can also load content from Google and Apple, to offer Google Pay and Apple Pay. Google and Apple may use their own cookies, under their own privacy policies (Google, Apple). Stripe's payment form runs whatever you chose in the cookie banner, so the banner does not turn these cookies off. On Stripe's own pages, Stripe sets its cookies on Stripe's domains. Stripe's cookie policy describes how Stripe uses cookies. Our Privacy Policy describes what Stripe's script collects on our payment page.
- Provider: Stripe, LLC, United States
- Purpose: Payment security and fraud prevention. If you use Link, keeping you signed in to Link
- Cookie type: On our payment page, first-party cookies set on passportcraft.com, and cookies that Stripe's payment form sets on Stripe's and hCaptcha's domains. On Stripe's own pages, cookies set on Stripe's domains
- Privacy policy: https://stripe.com/privacy
Google sign-in
On some pages we offer a prompt to sign in or create an account with your Google account. The prompt is offered whatever you chose in the cookie banner. Google provides it from accounts.google.com, under its own privacy policy. When the prompt starts, Google's script sets a cookie named g_state on passportcraft.com for up to 180 days. Google uses it to decide when to show the prompt again, and it holds a browsing-session identifier and test values of Google's. The entries we set for the prompt ourselves are also listed in Section 3.
YouTube
Some articles include a video. The player loads from youtube-nocookie.com only after you press play. YouTube may then store data in your browser under its own privacy policy.
Supabase
For signed-in users, Supabase manages session cookies for login state.
- Provider: Supabase, Inc., San Francisco, CA, USA
- Purpose: Authentication and session management only
- Cookie type: First-party
- Privacy policy: https://supabase.com/privacy
7. Do Not Track and Global Privacy Control
PassportCraft honors both Do Not Track (DNT) and Global Privacy Control (GPC) signals sent by your browser. When we detect either signal, we do not load analytics cookies regardless of region or your consent banner selection, and we treat GPC as a valid opt-out of any "sale" or "sharing" of personal information under applicable US state privacy laws.
US state privacy. PassportCraft does not sell your personal information and does not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar US state privacy laws. We honor GPC signals as an opt-out request regardless. For more detail on these rights and how we handle personal data, see our Privacy Policy.
8. Scanning a Digital Product Passport
PassportCraft hosts public Digital Product Passport (DPP) pages on behalf of the brands that use our Service. These are the pages a consumer reaches by scanning the QR code on a product or following its link.
The PassportCraft page template keeps at most one setting per passport on your device, and only in the browser tab you are using. Our own template for a public passport page sets no browser cookies and writes nothing to local storage. A passport page may suggest another language. If you close that suggestion, your browser remembers this in session storage for that browser tab only, so the suggestion does not return. The page does not access information on your device beyond what is strictly necessary to display the page you requested. The analytics cookies and consent banner described in this policy apply to passportcraft.com, not to the public passport pages.
We do, however, record limited information server-side each time a published passport page is viewed — an approximate location (country, region, and city) derived from your network, the time of the view, and a device type (mobile, tablet, or desktop) derived in memory from your browser's User-Agent. Your IP address (including any hashed form of it) and the User-Agent string itself are not stored. This information is not collected through cookies; it is derived from the request your browser makes to our servers. We use it to provide aggregate scan statistics to the publishing brand and to operate and improve the Service.
Because this collection does not rely on cookies or on accessing information stored on your device, it falls outside this Cookie Policy and is described in full — including the data collected, the purposes, the legal basis, the retention period, and your rights — in the "Consumers who scan a Digital Product Passport" section of our Privacy Policy. The content shown on each passport page is supplied and controlled by the publishing brand, not by PassportCraft. If a brand chooses to embed third-party images, media, fonts, or other external resources in its passport content, those resources are loaded from servers we do not control and may behave differently (for example, by setting their own cookies or storage); the publishing brand is responsible for those resources and for any consent they may require.
Where this information is provided. The public passport page does not currently display a separate privacy or data-collection notice on the page itself — its footer shows only a "Powered by PassportCraft" attribution. The handling of the limited server-side information described above is set out in our Privacy Policy, which is reachable at passportcraft.com/privacy. We plan to add a direct link to that Privacy Policy from the public passport page; until that link is in place, you can reach the relevant information by visiting passportcraft.com/privacy and reading the "Consumers who scan a Digital Product Passport" section. Where other PassportCraft materials refer to a notice "on the page itself," that reference should be read as pointing to the Privacy Policy at the address above.
9. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in our technology, legal requirements, or business practices. When we make changes, we will update the "Last updated" date at the top of this page.
When a change needs a consent you have not given, we will ask for it through our cookie banner before we rely on it.
10. Your Rights and More Information
Some cookies — in particular analytics cookies — may involve the processing of personal data. This Cookie Policy explains the cookies themselves; our broader handling of personal data, and the rights you have over it, are described in our Privacy Policy.
In particular, our Privacy Policy explains:
- Your rights of access, rectification, erasure, restriction, objection, and data portability
- Your right to withdraw consent at any time
- Your right to lodge a complaint with a supervisory authority
- How to reach our EU/UK representative, DataRep (see our Privacy Policy)
You can also exercise your cookie choices at any time through the cookie settings link in our footer, or by contacting us using the details below.
11. Contact Us
If you have questions about our use of cookies, please contact us:
Email: privacy@passportcraft.com
Postal address: PassportCraft LLC 418 Broadway, Ste N Albany, NY 12207 USA
Legal Basis
For visitors from the European Economic Area (EEA), United Kingdom, and Switzerland:
- Strictly necessary cookies are set under our legitimate interest in operating a functional website (GDPR Art. 6(1)(f)) and are exempt from consent requirements under Art. 5(3) of the ePrivacy Directive.
- Analytics cookies are placed only with your prior consent (GDPR Art. 6(1)(a)) for visitors in the EEA, UK, and Switzerland, in accordance with Art. 5(3) of the ePrivacy Directive — we do not set them until you accept. In other regions they may be set on an opt-out basis. You may decline or withdraw at any time via our consent banner.
- Functional storage remembers a choice you made in the application, such as a closed notice or a layout. It is set only when you make that choice, and clearing your browser storage removes it.
- Google sign-in. On some pages we offer the Google sign-in prompt whatever you chose in the banner, so that you can create an account with Google. Its entries, including the
g_statecookie that Google's script sets, are listed in Section 3. - Payment page. Our payment page runs Stripe's payment form whatever you chose in the banner, so that you can pay. Its cookies protect your payment against fraud. If you use Link, Link's cookies keep you signed in to Link. Sections 3 and 6 describe them.