Política de Cookies
Última actualización: 2026-06-24
Last updated: June 24, 2026
Website: passportcraft.com
Operator: PassportCraft LLC, 418 Broadway, Ste N, Albany, NY 12207, USA
Contact: privacy@passportcraft.com
1. What Are Cookies
Cookies are small text files that websites place on your device (computer, tablet, or phone) when you visit them. They help the website remember your preferences and understand how you interact with the site. Some cookies are deleted when you close your browser (session cookies); others remain on your device for a set period (persistent cookies).
We also use similar technologies such as local storage and pixel tags, which function in comparable ways. When we refer to "cookies" in this policy, we include all such technologies.
2. How We Use Cookies
We use a minimal set of cookies to operate our website and understand how visitors use it. Our cookies fall into the following categories:
Strictly Necessary Cookies
These cookies are essential for the website to function. They enable core features such as language preferences, navigation, and security. You cannot opt out of these cookies because the website cannot operate properly without them.
Analytics Cookies
These cookies help us understand how visitors interact with our website by collecting aggregated, anonymized usage data. We use this information to improve our content and user experience. Analytics cookies are set only with your consent. For visitors in the EEA, UK, and Switzerland, we do not place analytics cookies until you accept them via our consent banner; in other regions, analytics is enabled by default and you may opt out at any time. You can change your choice or withdraw consent at any time through the cookie settings link in our footer.
Functional Cookies
These cookies remember choices you make (such as your preferred language) to provide a more personalized experience. Some functional cookies overlap with strictly necessary cookies when the functionality is essential to site operation.
Note: PassportCraft does not currently use any marketing, advertising, or social media tracking cookies.
3. Cookie Inventory
Strictly Necessary Cookies
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
NEXT_LOCALE | passportcraft.com | Stores your preferred language/locale for the website | First-party | Session | Necessary |
suggested_locale | passportcraft.com | Stores a locale suggestion based on your geographic location | First-party | 1 day | Necessary |
geo_locale_dismissed | passportcraft.com | Records that you dismissed the locale suggestion banner | First-party | Session | Necessary |
pc_analytics_consent | passportcraft.com | Stores your cookie consent preference (via browser local storage) | First-party | Persistent (no fixed expiry; stored until you change it or clear your browser storage — see Section 4) | Necessary |
Analytics Cookies
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
_ga | Google (analytics.google.com) | Distinguishes unique visitors for analytics | First-party | 2 years | Analytics |
_ga_G-0QFWJ9W821 | Google (analytics.google.com) | Maintains session state for Google Analytics | First-party | 2 years | Analytics |
Note on duration vs. data retention. The "2 years" shown above is the browser-side expiry of the analytics identifier cookie — the period after which your browser deletes the cookie if you do not return. It is distinct from how long we retain the underlying analytics data: as explained in our Privacy Policy, analytics data is retained for 12 months from collection and then purged. In other words, the cookie identifies your browser for up to 2 years, but the data associated with it is deleted after 12 months.
Application Cookies (Signed-in Users)
When you create an account and sign in, the following strictly necessary cookies are set to operate the application:
| Cookie Name | Provider | Purpose | Type | Duration | Category |
|---|---|---|---|---|---|
sb-<project>-auth-token | Supabase (supabase.com) | Authentication session for signed-in users | First-party | Session / refresh-token lifetime | Necessary |
__stripe_mid | Stripe (stripe.com) | Fraud prevention during payment processing | First-party | 1 year | Necessary |
__stripe_sid | Stripe (stripe.com) | Fraud prevention during payment processing | First-party | 30 minutes | Necessary |
4. Consent
We use a cookie consent banner that appears when you first visit our website. The banner presents "Accept" and "Decline" options with equal prominence, with nothing pre-selected. Through it you can:
- Accept analytics cookies
- Decline non-essential cookies
- Change your preferences at any time via the cookie settings link in our footer
How consent works by region. For visitors in the EEA, UK, and Switzerland, analytics cookies are not placed until you actively accept them (prior opt-in). For visitors elsewhere, analytics is enabled by default and you may opt out at any time. Only strictly necessary cookies cannot be disabled, as they are required for the website to function.
We also honor the Global Privacy Control (GPC) and Do Not Track (DNT) browser signals: if your browser sends either, we treat it as a refusal of analytics cookies regardless of region. You can withdraw your consent at any time; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
How your choice is stored. When you accept or decline analytics cookies, we save your choice as a single value (granted or denied) in your browser's local storage under the name pc_analytics_consent. This choice is stored only in your browser; it does not currently include a timestamp, version, or server-side log. Because it is held in your browser, your choice persists until you change it through the cookie settings link in our footer or clear your browser's storage. We do not currently set a fixed expiry that automatically re-prompts you after a set period, although we will re-prompt you for consent if we make material changes to our use of cookies (see Section 9). If you use a different browser or device, or clear your storage, you will be asked again.
More information about your rights. Analytics cookies may involve the processing of personal data. For a full description of how we handle personal data — including your rights of access, rectification, erasure, objection, and the right to lodge a complaint with a supervisory authority, as well as details of our EU/UK representative (DataRep) — please see our Privacy Policy.
5. How to Manage Cookies
In addition to our consent banner, you can control cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored on your device
- Delete individual or all cookies
- Block cookies from specific or all websites
- Set preferences for first-party vs. third-party cookies
Here are links to cookie management instructions for common browsers:
Please note: Blocking strictly necessary cookies may impair the functionality of our website, such as language selection and navigation.
6. Third-Party Cookies
Google Analytics
We use Google Analytics for website analytics. Google Analytics processes data on our behalf to help us understand visitor behavior (pages viewed, time on site, navigation paths).
- Provider: Google LLC, Mountain View, CA, USA
- Data processed: Page views, session data, device type, browser type, approximate location (country/region level)
- Cookie type: First-party (set under our domain)
- Transfers: Data is transferred to the United States. Google participates in the EU-US Data Privacy Framework. See their privacy policy for details.
- Opt-out: You can opt out via our cookie consent banner or by using browser cookie settings. You can also install Google's Google Analytics Opt-out Browser Add-on (available for Chrome, Firefox, Safari, and Edge), or read more about how Google uses information from sites or apps that use its services.
Stripe
For payments, Stripe sets cookies strictly necessary for fraud prevention during checkout.
- Provider: Stripe, Inc., San Francisco, CA, USA
- Purpose: Payment security and fraud prevention only
- Cookie type: First-party
- Privacy policy: https://stripe.com/privacy
Supabase
For signed-in users, Supabase manages session cookies for login state.
- Provider: Supabase, Inc., San Francisco, CA, USA
- Purpose: Authentication and session management only
- Cookie type: First-party
- Privacy policy: https://supabase.com/privacy
7. Do Not Track and Global Privacy Control
PassportCraft honors both Do Not Track (DNT) and Global Privacy Control (GPC) signals sent by your browser. When we detect either signal, we do not load analytics cookies regardless of region or your consent banner selection, and we treat GPC as a valid opt-out of any "sale" or "sharing" of personal information under applicable US state privacy laws.
US state privacy. PassportCraft does not sell your personal information and does not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) and similar US state privacy laws. We honor GPC signals as an opt-out request regardless. For more detail on these rights and how we handle personal data, see our Privacy Policy.
8. Scanning a Digital Product Passport
PassportCraft hosts public Digital Product Passport (DPP) pages on behalf of the brands that use our Service. These are the pages a consumer reaches by scanning the QR code on a product or following its link.
The PassportCraft page template does not place cookies on your device. Our own template for a public passport page does not set any cookies, local storage, or similar technologies, and does not access information on your device beyond what is strictly necessary to display the page you requested. The analytics cookies and consent banner described in this policy apply to passportcraft.com, not to the public passport pages.
We do, however, record limited information server-side each time a published passport page is viewed — an approximate location (country, region, and city) derived from your network, the time of the view, and a device type (mobile, tablet, or desktop) derived in memory from your browser's User-Agent. Your IP address (including any hashed form of it) and the User-Agent string itself are not stored. This information is not collected through cookies; it is derived from the request your browser makes to our servers. We use it to provide aggregate scan statistics to the publishing brand and to operate and improve the Service.
Because this collection does not rely on cookies or on accessing information stored on your device, it falls outside this Cookie Policy and is described in full — including the data collected, the purposes, the legal basis, the retention period, and your rights — in the "Consumers who scan a Digital Product Passport" section of our Privacy Policy. The content shown on each passport page is supplied and controlled by the publishing brand, not by PassportCraft. If a brand chooses to embed third-party images, media, fonts, or other external resources in its passport content, those resources are loaded from servers we do not control and may behave differently (for example, by setting their own cookies or storage); the publishing brand is responsible for those resources and for any consent they may require.
Where this information is provided. The public passport page does not currently display a separate privacy or data-collection notice on the page itself — its footer shows only a "Powered by PassportCraft" attribution. The handling of the limited server-side information described above is set out in our Privacy Policy, which is reachable at passportcraft.com/privacy. We plan to add a direct link to that Privacy Policy from the public passport page; until that link is in place, you can reach the relevant information by visiting passportcraft.com/privacy and reading the "Consumers who scan a Digital Product Passport" section. Where other PassportCraft materials refer to a notice "on the page itself," that reference should be read as pointing to the Privacy Policy at the address above.
9. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in our technology, legal requirements, or business practices. When we make changes, we will update the "Last updated" date at the top of this page.
For material changes (such as adding new cookie categories or new third-party providers), we will re-prompt you for consent through our cookie banner.
10. Your Rights and More Information
Some cookies — in particular analytics cookies — may involve the processing of personal data. This Cookie Policy explains the cookies themselves; our broader handling of personal data, and the rights you have over it, are described in our Privacy Policy.
In particular, our Privacy Policy explains:
- Your rights of access, rectification, erasure, restriction, objection, and data portability
- Your right to withdraw consent at any time
- Your right to lodge a complaint with a supervisory authority
- How to reach our EU/UK representative, DataRep (see our Privacy Policy)
You can also exercise your cookie choices at any time through the cookie settings link in our footer, or by contacting us using the details below.
11. Contact Us
If you have questions about our use of cookies, please contact us:
Email: privacy@passportcraft.com
Postal address: PassportCraft LLC 418 Broadway, Ste N Albany, NY 12207 USA
Legal Basis
For visitors from the European Economic Area (EEA), United Kingdom, and Switzerland:
- Strictly necessary cookies are set under our legitimate interest in operating a functional website (GDPR Art. 6(1)(f)) and are exempt from consent requirements under Art. 5(3) of the ePrivacy Directive.
- Analytics cookies are placed only with your prior consent (GDPR Art. 6(1)(a)) for visitors in the EEA, UK, and Switzerland, in accordance with Art. 5(3) of the ePrivacy Directive — we do not set them until you accept. In other regions they may be set on an opt-out basis. You may decline or withdraw at any time via our consent banner.