Cookie Policy

This Cookie Policy explains what cookies and similar technologies we use on snowcone.app, developers.snowcone.app, and related properties (the "Service"); why we use them; how to manage them; and how regional rules apply. It supplements our Privacy Policy — read both together.

Cookies are small files a website stores on your device. They are used for many purposes — for example, keeping you signed in, remembering your country, and measuring how the site performs.

This policy uses "cookies" as shorthand for cookies and any similar technology that stores or reads information on your device, including localStorage, IndexedDB, web beacons / pixels, SDK identifiers, and server-side identifiers we set in HTTP responses. The European Court of Justice (Planet49, C-673/17) and the regulator guidance from CNIL and the UK ICO treat these technologies the same way for consent-and-information purposes.

We do not use canvas fingerprinting, audio fingerprinting, or other browser-fingerprinting techniques to identify devices. Bot detection on the Service is performed via Cloudflare Turnstile, which uses challenge-response (not fingerprinting) to assess whether a request is automated.

We organise cookies into four categories. Each category can be turned on or off independently from the cookie banner or from the persistent footer link "Cookie preferences". Strictly necessary cookies cannot be turned off — without them the Service does not work.

3.1 Strictly necessary

These are cookies and similar technologies that are essential for the Service to function: signing you in, keeping items in your cart, preventing fraud, balancing load across our servers, and remembering your cookie preferences themselves.

3.2 Functional

These remember your preferences so the site works the way you configured it. They are off by default in opt-in regions (EEA, UK, CH, IS, NO) and on by default elsewhere with notice.

3.3 Analytics

These help us understand how the Service is used so we can improve it. They are off by default in opt-in regions and on by default elsewhere with notice.

3.4 Marketing

Marketing cookies and pixels would be used for retargeting and attribution. v1 of the Service does not load any marketing cookies or pixels. If we add them in the future they will require affirmative consent everywhere — in opt-in regions and in opt-out regions alike — and we will publish the change at least 30 days before it takes effect.

Non-essential cookies are off by default for every Snowcone user, in every country we serve. Functional, analytics, and marketing cookies require your affirmative consent before they load. Strictly necessary cookies (section 3.1) load without consent because the Service does not work without them. We do not vary this posture by country.

Why a single global default rather than per-region settings: the regulatory direction of travel — EU EDPB transparency enforcement, the UK ICO's post-DUAA-2025 PECR ceiling (£17.5 million / 4% global turnover), the California Attorney General's Disney $2.75M cross-device-opt-out theory, the UK CMA's dark-patterns priority — converges on the EEA opt-in floor as the operating standard. Per-region defaults would be a maintenance and audit liability with no user benefit. ADR-0068 §6 records this decision.

The cookie banner is the same in every market: a modal with equal-weight Accept and Reject buttons, with a "Manage preferences" option surfaced before "Accept all" (the EEA / UK shape, generalised). The Global Privacy Control signal (section 5) is honored everywhere as a declined-consent decision and skips the banner entirely.

Sensitive personal information. Where processing involves sensitive personal information (for example, photos of identifiable individuals submitted with reviews), we obtain a separate explicit opt-in at the point of submission, on top of the cookie consent above. This posture applies globally as a uniform standard.

Country detection remains operationally relevant for tax, currency, language, fulfillment, and the selection of country-mandated parallel documents — it is just no longer used for cookie-default differentiation.

We honor the Global Privacy Control signal. If your browser is configured to send navigator.globalPrivacyControl = true (built into Brave, DuckDuckGo Browser, Firefox, and a number of privacy-focused extensions), we treat it as your decision and:

• In US states with comprehensive privacy laws — we treat the signal as a "do not sell or share" instruction under CCPA / CPRA Cal Civ Code §1798.135(b) and equivalent state-law provisions.
• In the EEA and UK — we treat the signal as a declined-consent decision: marketing and analytics are off, the banner is skipped, and a consent-log row is recorded with surface = 'gpc_inferred'.
• Cross-device propagation. Once you sign in, the GPC decision propagates to your account and applies on every other device you sign in with — not only the device that originally sent the signal. This addresses the operative theory in California Attorney General People v. Walt Disney Co. (CCPA settlement, early 2026).
• Propagation to third-party tags. When GPC is signaled, the consent gate that controls third-party tag-injection drops every queued analytics and marketing tag — propagation is not "first-party only".

You can override GPC for our Service by visiting the persistent footer link "Cookie preferences" and choosing categories manually — your manual choice always wins over the automatic signal.

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the California CCPA / CPRA and analogous state laws. This is the v1 posture and it does not depend on any opt-out by you.

California, Colorado, Connecticut, Virginia, Utah, Texas, and other state laws still give you a right to opt out preemptively. Use the footer link "Do Not Sell or Share My Personal Information" or set GPC in your browser. The opt-out is recorded on your account and propagates across devices once you sign in.

California residents may also limit our use of sensitive personal information (CPRA §1798.121) — for example, to constrain how we use review photos that depict you. Use /privacy-requests for that request.

• From the cookie banner — when it first appears, choose Accept all, Reject all, or Manage preferences.
• From the persistent footer link — "Cookie preferences" reopens the banner from any page. Withdrawing a category causes the corresponding cookies to be deleted on next page load.
• From your browser — most browsers let you delete cookies for a site or block them entirely. Doing this for strictly necessary cookies will prevent the Service from working.
• Via Global Privacy Control — see section 5.
• Via /privacy-requests — for a record of every consent decision tied to your account.

Withdrawing consent does not affect the lawfulness of processing carried out before your withdrawal (GDPR Art 7(3)).

• We do not use canvas, audio, or other browser-fingerprinting techniques.
• We do not use session-replay, heatmap, or screen-recording tools (FullStory, Hotjar, LogRocket, or equivalents). If we ever add one we will treat it as a major Cookie Policy change with prior notice and explicit consent.
• We do not run cross-context behavioral advertising; we do not place retargeting pixels on other sites.
• We do not use the IAB Transparency and Consent Framework (TCF) consent string in v1; if we ever join an adtech ecosystem that requires it we will say so.
• We do not load Google Analytics, Meta Pixel, TikTok Pixel, LinkedIn Insight, or similar third-party advertising tags.

The third parties that receive cookie-derived data are listed on our public sub-processor page at /legal/sub-processors. That page is the canonical disclosure; the cookie-table references in section 3 above are summary entries.

Snowcone is not directed to children. We do not knowingly set non-essential cookies on devices used by children below the minimum age in your country. Minimum-age detail is in the Privacy Policy, section 14.

The version number and effective date appear at the top of this page. If we add a new processing purpose, a new category of cookie, or a new sub-processor that meaningfully changes who receives your cookie-derived data, we treat the change as material: we re-prompt your consent on the next page load, post notice at least 30 days before the change takes effect, and email signed-in users.

For cookie-related questions, write to privacy@snowcone.app or visit /privacy-requests.

If you are not satisfied with our response, you can complain to a regulator. The list is in our Privacy Policy section 17. The most relevant authorities for cookie issues:

• EEA — your national data protection authority; France's CNIL has been the most active enforcer of cookie rules in recent years.
• United Kingdom — the Information Commissioner's Office: ico.org.uk. The ICO has been auditing the top 1,000 UK websites for cookie compliance and has the power to issue fines up to £17.5 million or 4% of global turnover under PECR (as amended by the Data (Use and Access) Act 2025).
• California — the California Privacy Protection Agency (CPPA) and the California Attorney General.

The current version and effective date appear at the top of this page. Sub-processor changes are tracked separately at /legal/sub-processors.