Cookie Policy
Last updated: 2026-08-23
This page lists every cookie Shotsmith sets. It is a short list, and that is deliberate.
The short version
We set three cookies, all of them strictly necessary: one to keep you signed in, one to stop forged requests, and one to remember your cookie choices if we ever ask for them.
We run no analytics. There is no Google Analytics, no Meta pixel, no advertising tag, and no third-party script on the marketing site. Nothing here follows you to another website.
Because everything we set is strictly necessary, ePrivacy does not require us to ask your permission for any of it — and so we do not interrupt you with a banner asking for something we do not need.
What a cookie is
A small file a website asks your browser to keep, and sends back on the next request. It is how a site knows the request that just arrived is from the same browser as the last one — which is what being "signed in" means.
The cookies we set
Strictly necessary
These cannot be turned off without breaking the site. They carry no advertising identifier and are readable only by us.
| Cookie | Purpose | Expires |
|---|---|---|
shotsmith_session |
Identifies your browsing session. Without it, signing in is impossible: every page would look like a stranger arriving. | When you close the browser, or after 2 hours idle |
XSRF-TOKEN |
Proves a form submission came from our page and not from another site acting as you. Standard protection against cross-site request forgery. | Same as the session |
shotsmith_consent |
Records your cookie choices, so we do not ask twice. Only set once you have answered. | 12 months |
Analytics
None. We do not currently measure visits with cookies at all.
Advertising
None. We do not run advertising on the site and we do not set cookies for any advertising network.
Cookies set by other companies
When you pay, checkout happens on Stripe's own pages. Stripe sets its own cookies there, for fraud prevention and to make the payment work, and those are governed by Stripe's privacy policy at https://stripe.com/privacy. They are set on Stripe's domain, not ours, and we cannot read them.
Nothing else embeds a third party. There is no YouTube player, no map, no chat widget, no social embed.
If this changes
If we ever add analytics or anything else that is not strictly necessary, it will be off until you switch it on. A consent banner will appear, the category will be listed here with the cookies it sets, and nothing in that category will load until you agree.
There will be no pre-ticked boxes and no "by continuing to browse you consent", because neither of those is consent.
Controlling cookies yourself
Every browser lets you view, block and delete cookies, usually under Settings → Privacy. Blocking the two strictly necessary cookies above will stop you being able to sign in — that is not us being obstructive, it is what those cookies do.
Do Not Track and Global Privacy Control
We set no tracking cookies, so there is nothing for these signals to switch off. If we ever add an optional category, a Global Privacy Control signal will be treated as a refusal of it.