1. Essential cookies
These are required for the Service to work. They cannot be turned off without breaking sign-in.
- Auth.js session cookies — keep you signed in (HttpOnly, SameSite=Lax).
- tos-ref — referral handle, set when you visit a referral link, valid 30 days.
- tos-signup-country — short-lived (1 hour) cookie that carries your country choice from the signup page into account creation.
- NEXT_LOCALE — language preference (when localization is enabled).
2. Preference storage (localStorage)
- tos-theme — your dark / light theme choice.
- tos-text-size — your text-size selection (S / M / L / XL / XXL).
- tos-stamp-seen:<hash> — flags whether you’ve already seen the stamp ceremony for a given record (so it doesn’t replay every visit).
3. Analytics
We use Vercel’s built-in request analytics (anonymized, no cookies set). When the Concierge is enabled, the Anthropic SDK does not store cookies in your browser; the prompt cache lives server-side.
We do not use Google Analytics, Facebook Pixel, advertising trackers, or third-party cross-site tracking.
4. Third-party cookies
When you authenticate via Google or Facebook OAuth, those providers set their own cookies on their domains during the flow. Their cookies are governed by their respective privacy policies — they are not under our control.
5. How to control cookies
You can clear cookies and localStorage from your browser’s privacy settings at any time. If you clear the auth session cookie, you’ll be signed out. If you clear preference storage, your theme and text-size return to defaults.
We do not currently show a cookie consent banner because we only use essential cookies + your local preferences. When we add any non-essential cookies, we’ll add a banner with an opt-in for EU/UK visitors.
6. Contact
Questions: privacy@tattooos.ink