Last updated: 13 November 2026
The short version
The only third-party advertising cookies here are those of the Google Ads tag, which tell Google whether one of its ads led to a subscription, and only with your consent where the law requires it. They are used to measure ads, not to show you personalised ads. No Google Analytics, no social media pixels.
Some of our own cookies are essential: they keep you signed in and let you use the tools without an account. The rest serve only to measure visits on our own servers — which pages are read and which ads bring people who end up subscribing.
Whether we ask first depends on where you are:
- In the European Economic Area, the United Kingdom or Switzerland, a banner asks you before anything that is not essential is set. Until you answer, we count your visit without storing anything on your device (see Counting visits without a cookie below).
- Everywhere else, the law does not require consent in advance, so the banner does not appear and the measurement cookie is set from the first page. You can say no at any time with the button at the end of this page.
We work out where you are from your IP address, on our own server, without calling any outside service.
Which ones
| Cookie | Purpose | Duration |
|---|---|---|
aib_session | Keeps you signed in. It is httpOnly: the page's JavaScript cannot read it. | 30 days |
aib_auth | Only indicates that a session exists, so the header can show the right button without waiting for a request. It cannot identify you. | 30 days |
aib_guest | Lets you use the tools without an account and find your files again in your dashboard once you sign up. | 30 days |
aib_visitor | Measurement. Distinguishes one visit from another in our analytics, and remembers which ad brought you if you later subscribe. Only set with consent in Europe; outside Europe, until you say no. | 12 months |
aib_consent | Remembers your answer to the cookie banner, so we don't ask again. | 12 months |
imagefy_currency | Remembers the currency you see prices in. | 12 months |
aib_google | Only while you sign in with Google: checks that the return from Google belongs to the sign-in you started. | 10 minutes |
sidebar_state | Remembers whether the dashboard sidebar is open or collapsed. | 7 days |
_gcl_au, _gcl_aw | Advertising, set by Google. Store the identifier of the Google ad you clicked, so Google can attribute a later subscription to it. Only set with consent in Europe; outside Europe, until you say no. | 90 days |
For the session, guest and visitor cookies, we store a hash of the value in our database rather than the value itself. Even someone with access to our database could not reconstruct the cookie.
What we keep in your browser
Besides cookies, your browser keeps a few things that never reach us and disappear when you clear your browsing data:
imagefy-crear-…(local storage): what you had filled in on a creation screen, so reloading doesn't lose it. Discarded after 24 hours.imagefy-crear(IndexedDB): the photo you added on a creation screen, for the same reason. Discarded after 24 hours.imagefy-codigo-enviado(session storage): remembers that we already emailed you a confirmation code, so we don't send another. Gone when you close the tab.- A copy of the AI models used by the tools that run on your device, so they don't have to be downloaded again.
Counting visits without a cookie
If you have not accepted measurement cookies, we still count your visit, but nothing is stored on your device. Instead, our server groups the pages of one visit using a one-way hash of your IP address, your browser's user agent and a secret that changes every day. The raw IP address is not stored, and because the secret rotates daily, the hash cannot be used to recognise you on another day.
Cookies set by other services
Four services may set their own cookies, and only where they are needed:
- Cloudflare Turnstile, which checks that you are not a robot, on the sign-up, sign-in and waiting-list forms. It replaces a traditional captcha and is specifically designed not to track anyone.
- Stripe, at checkout, for fraud prevention.
- Google, only if you choose "Accept all" and are not signed in: we load Google's sign-in service so it can offer, in a small window, to sign you in with the Google account already open in your browser. Google's policy applies to it. With Essential only, it is not loaded.
- Google, through the Google Ads tag (the
_gclcookies in the table above), with consent in Europe and, elsewhere, until you say no. When you sign up, sign in or start a trial, it also sends Google a SHA-256 hash of your email address, computed in your browser, so Google can match the subscription to its ad. Your email address itself is not sent. Ad personalisation is switched off.
If you do not open those forms or a payment screen, Turnstile and Stripe are not loaded. Signing in with the Google button takes you to Google's own site, where Google's policy applies.
Changing your mind
The button at the end of this page opens the cookie choice again, wherever you are. Choosing Essential only removes the measurement cookie, tells the Google tag to stop storing and sending data, and we go back to counting visits without storing anything on your device.
How to remove them
Your browser lets you delete or block them. Note, however, that if you block the session cookies you will not be able to sign in — not because of any restriction on our part, but because the session is that cookie. Deleting aib_guest also makes the site forget which files you uploaded without an account.
Questions
Write to support@imagefy.ai. Details of the data we process are in the privacy policy.