Legal
Cookie Policy
Last updated: September 27, 2026
PrismPoster only loads optional analytics and marketing tools after you opt in. Essential cookies and storage stay active because they keep authentication, security, consent records, referral attribution, and core product workflows working.
1. What cookies and similar technologies are
Cookies are small files stored by your browser. Similar technologies include local storage, session storage, SDK identifiers, and browser signals used to remember choices or measure site behavior.
2. What we use before consent
These items are necessary for the service and cannot be switched off inside PrismPoster. You can still block them in your browser, but parts of the service may stop working.
| Name | Purpose | Duration |
|---|---|---|
| next-auth session and CSRF cookies | Keeps you signed in and protects sign-in forms. | Up to 7 days, refreshed while you stay active. |
| cookie-consent-preferences | Stores your cookie choices in browser local storage. | Until cleared by you or your browser. |
| pp_cookie_consent | First-party fallback that remembers your consent choice on this site. | Up to 12 months. |
| prism_ref | Set only when you arrive through a referral link (a ?ref= URL). It remembers the referral code so the person who referred you is credited if you sign up. First-party. | Up to 90 days. |
| prism_did | An opaque random identifier for this browser, set on your first visit and used only to stop one person claiming the free starter credits or the free preview clip repeatedly from a single device. It is a random value that lets us recognise the same browser claiming twice. First-party and httpOnly, never shared with anyone, and never used for advertising or analytics. | Up to 400 days. |
| prism_dsig | Set on your first visit. It holds signed, one-way identifiers derived from technical characteristics your browser and device report (such as how they draw graphics and play audio, the screen, and hardware capabilities), used for the same single purpose as prism_did: one free starter grant and one free preview clip per person. The characteristics themselves are not kept. First-party and httpOnly. | Up to 400 days. |
| prism_free_clip | Set only if you make the free preview clip on the image-to-video page without an account. A signed reference to that clip so you can view it and keep it when you sign up. First-party and httpOnly. | Up to 30 days. |
| pp_waiver_ack | Set when you tick the withdrawal acknowledgment before buying credits or a plan, so the checkout page can carry your statutory acknowledgment. First-party, sent only to the checkout page. | 15 minutes. |
| consent-session-id (session storage) | A random ID that links your cookie choice to our consent record when you are not signed in. | Until you close the tab. |
| NEXT_LOCALE / pp_lang_hint_dismissed | Remember the display language you chose, and that you dismissed the language-suggestion banner, so the site renders in your language without asking again. First-party. | Up to 12 months. |
| pp-theme / pp-light-ok | Remember your light/dark theme choice (browser local storage plus a first-party cookie) so pages render in your theme without flashing. | Up to 12 months. |
| pp_currency / pp_resolved_currency | Remember which currency to show prices in. We infer an approximate country from your IP address to choose a default currency; you can override it any time with the currency switcher. Used only to localize pricing — your IP address is not stored for this purpose. First-party. | Up to 12 months, or until you change it. |
| pp_country | Holds the two-letter country inferred from your IP address, so the pricing and checkout pages can tell you which payment methods (for example UPI or Pix) the payment form will offer you. Refreshed on each visit and removed when no country can be inferred. First-party. | Up to 30 days. |
| pp_starter_region | Holds one digit worked out from that same country: whether new accounts there receive free starter credits (1) or not (0), so the site can tell you before you sign up, and name the price of a first credit pack where they are not offered. It holds no country and nothing about you. Refreshed on each visit and removed when no country can be inferred. First-party. | Up to 30 days. |
| Core app storage | Remembers drafts, workspace state, security checks, and settings needed to provide requested features. | Varies by feature; removable through browser storage controls. |
3. Optional categories
Analytics
Used to understand product usage, performance, and page quality. This category can include PostHog (including session replay), Google Analytics (GA4, which sets _ga and _ga_<id> cookies for up to 2 years under Google Consent Mode), and Sentry session replay, plus the first-party prism_utm cookie, which records the marketing campaign (UTM tags) and referring page that brought you to the site so we can attribute the channel. Every tool and cookie named in this paragraph loads or is written only after you grant analytics consent, and they are removed or expire when you withdraw it. The prism_utm cookie lasts up to 90 days. PostHog stores ph_* items in cookies and browser storage, including a 30-minute ph_pp_sid session cookie. Session replays mask all on-screen text, form inputs and media. Cookieless measurement is described separately below and does not depend on this choice.
Browser Do Not Track and Global Privacy Control also keep analytics and marketing off.
Cookieless usage measurement (no consent required)
Separately from the tools above, we count page views and product actions on our own servers without using any cookie. Nothing is stored on your device for this. While you are signed out, our server identifies your visit by a code it derives from your IP address, browser user-agent and the current date, instead of storing an identifier on your device. The code changes every day, so your signed-out visits are not linked from one day to the next, and we do not store your IP address for this. While you are signed in, these events are recorded against your account.
We use this to see how many people visit, which pages and studios they use, and where they run into problems. It stays on our own infrastructure and is never sent to an advertising network or used to build a marketing profile.
If your browser sends Global Privacy Control or Do Not Track, we skip our first-party counting too. If you have an account, you can switch it off entirely in privacy settings.
Functional
Used for optional personalization beyond the core service. With Functional consent, ticking “Remember me” at sign-in stores the email you last signed in with (pp_remembered_email, browser local storage) so the login form can pre-fill it; it is removed when you untick “Remember me” or withdraw Functional consent. This category is off unless you choose it or accept all cookies.
Marketing
With Marketing consent we load the Google Ads tag to measure whether our ads on Google lead to visits and sign-ups. It sets first-party cookies whose names begin with _gcl_ (such as _gcl_au, and _gcl_aw after you click one of our ads) for up to 90 days, and Google may set or read its own advertising cookies on its domains. Google receives your IP address, browser details, the page you visited and any ad-click identifier, and uses them as an independent controller under its own privacy policy. We do not use this for remarketing or personalised ads, and we do not sell your personal information.
Nothing in this category loads until you opt in. Withdrawing Marketing consent stops the tag and removes the _gcl_ cookies, and Global Privacy Control or Do Not Track keep this category off.
4. Third-party services
Some providers process limited technical data when their services are used. Payment processors set fraud-prevention cookies during checkout: Stripe sets __stripe_mid (up to 1 year) and __stripe_sid (30 minutes). When you sign up with an email address, Google reCAPTCHA checks that the request comes from a person; it reads browser and device signals, may read or set its own cookies, and Google processes that data under its own privacy policy and terms. Error and performance telemetry may run as service-reliability tooling on our legitimate interest in keeping the service secure and available, but session replay stays disabled unless analytics consent is present.
For the current processor list, see our Sub-Processors page.
5. Managing your preferences
You can change your choices at any time with Cookie Settings. Declining analytics removes known analytics cookies and PostHog browser storage. You can also clear cookies and site data in your browser.
If your browser sends Global Privacy Control, PrismPoster records an essential-only choice and treats the signal as an opt-out from optional analytics and marketing.
Current consent version: 2026-09-24.
6. Contact us
If you have questions about cookies or privacy, contact us at dpo@prismposter.com.
PrismLabs OÜ
Sepapaja tn 6, 15551 Tallinn, Harju County
Estonia
See also our Privacy Policy, privacy choices, and Terms of Service.