Cookie Policy
Every cookie and browser storage item PhotoForPass uses, by category, with provider, purpose and duration, plus Google Consent Mode, GPC and how to change your choices.
Effective date: November 8, 2026
This Cookie Policy explains how HELPERG LLC (“PhotoForPass”, “we”, “us”) uses cookies and similar technologies on photoforpass.com (the “Service”). Please read it together with our Privacy Policy.
What cookies are
Cookies are small text files that a website stores in your browser. Similar technologies include local storage, which keeps data until it is cleared, and session storage, which is cleared when you close the browser tab. In this policy, we call all of these “cookies” unless we say otherwise.
- First-party items are set by photoforpass.com.
- Third-party items are set by another company, such as Stripe, Google, Microsoft or Cloudflare.
How consent works on our site
| Category | Default | Can you turn it off in our settings? |
|---|---|---|
| Strictly necessary | Always on | No, the Service cannot work safely without these |
| Functional and first-party measurement | Always on | No, but they stay in your browser or are sent only to us, and you can clear them in your browser at any time |
| Analytics | Off until you accept | Yes |
| Marketing | Off until you accept | Yes |
The cookie banner gives you three options: Accept all, Reject non-essential, or Customize to choose analytics and marketing separately. You can change your mind at any time with “Cookie settings” in the site footer.
Google Consent Mode
We use Google Consent Mode v2. Google’s tag loads on every page, but before you choose, and whenever you decline, all of its analytics and advertising storage is set to “denied”:
- While consent is denied, Google’s tag does not set or read analytics or advertising cookies.
- It may still send Google cookieless pings, which contain information such as the page, time, browser type and your consent status, plus the IP address that every internet request carries. Google uses these pings for aggregated modeling.
- Ad click identifiers in the link you followed may be passed between our pages in the page address, instead of in cookies.
- Advertising data in these pings is redacted.
When you accept analytics, Google Analytics can set its cookies. When you accept both analytics and marketing, Google Analytics may also use Google signals, explained below.
Global Privacy Control (GPC)
If your browser sends a Global Privacy Control signal, analytics and marketing stay off, and the switches for them in our cookie settings are locked off while GPC is on. We treat GPC as a request to opt out of the sale or sharing of your personal information. Google’s tag may still send the cookieless pings described above.
Strictly necessary
These make the Service work: they remember your consent choice, keep you signed in, secure payments and block bots. They do not require consent.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
pfp_consent |
PhotoForPass | First-party cookie | Remembers your cookie choices and when you made them | 180 days |
pfp_s |
PhotoForPass | First-party cookie (HttpOnly, secure) | Keeps you signed in. Set only if you sign in | 30 days, or until you sign out |
Firebase Authentication data (browser storage entries beginning with firebase) |
Google Firebase, on photoforpass.com | First-party local storage or IndexedDB | Completes and keeps your sign-in with an email link or Google account. Set only if you sign in | Until you sign out |
__stripe_mid |
Stripe, on photoforpass.com | First-party cookie set by Stripe | Payment fraud prevention. Set on checkout | 1 year |
__stripe_sid |
Stripe, on photoforpass.com | First-party cookie set by Stripe | Payment fraud prevention. Set on checkout | 30 minutes |
Cloudflare Turnstile and security cookies (such as __cf_bm or cf_clearance, if set) |
Cloudflare | First-party or third-party cookie | Tells people apart from bots and protects forms from abuse | Up to 30 minutes for __cf_bm. cf_clearance lasts as set by Cloudflare’s challenge settings |
When you pay, Stripe may also set its own cookies on Stripe domains (such as stripe.com and link.com), for example to remember you for Stripe Link if you choose. When you use “Sign in with Google”, Google sets its own cookies on Google domains. These are covered by Stripe’s and Google’s own cookie and privacy policies.
Functional and first-party measurement
These support features you see and our own anonymous statistics. They stay in your browser or are sent only to our own servers. We do not share them with advertising companies, and we do not use them to follow you on other websites.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
pfp_promo |
PhotoForPass | Local storage | Holds the status and expiry time of the welcome offer, so the timer and discount work across pages | The offer lasts up to 59 minutes. Afterward we keep only a note that it expired, so it is not shown again, until you clear your browser storage |
pfp_promo_declined |
PhotoForPass | Local storage | Remembers that you said “no thanks” to the welcome offer, so we do not show it again | Until you clear your browser storage |
pfp_promo_dismissed |
PhotoForPass | Session storage | Remembers that you closed the offer pop-up during this visit | Until you close the tab |
pfp_attr |
PhotoForPass | Local storage | Remembers how you first and most recently found us: campaign tags in the link (such as source, medium and campaign), the referring website, the landing page, and a yes or no flag for whether the link had an ad click identifier (the identifier itself is not stored). Attached to your sign-up or order | Until you clear your browser storage |
pfp_sid |
PhotoForPass | Session storage | A random ID for the current tab, used to group page views in our anonymous page counters. It is not linked to your IP address, account or any other identifier | Until you close the tab. Counter data is kept for 13 months |
Analytics
These help us understand how people use the Service so we can improve it. They are used only after you accept analytics.
| Name | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
_ga |
Google Analytics 4 | First-party cookie | Distinguishes visitors to measure usage | 2 years |
_ga_<id> |
Google Analytics 4 | First-party cookie | Keeps track of the current session | 2 years |
_clck |
Microsoft Clarity | First-party cookie | Stores a Clarity user ID so visits can be grouped | 1 year |
_clsk |
Microsoft Clarity | First-party cookie | Connects page views into a single session recording | 1 day |
CLID |
Microsoft Clarity (clarity.ms) | Third-party cookie | Identifies the first time Clarity saw this browser | 1 year |
What Clarity records. Microsoft Clarity creates heatmaps and session replays that show clicks, scrolls and page layout. Text you type into form fields is masked, and the photo capture and preview areas are masked, so your photos are not captured in recordings. Clarity loads only after you accept analytics.
Marketing
We do not set separate marketing cookies of our own. When you accept marketing:
- Google’s advertising consent signals (ad storage, ad user data and ad personalization) are set to “granted”.
- If you have also accepted analytics, Google Analytics may use Google signals. Google signals lets Google associate your visits with your Google account, if you are signed in to Google and have turned on ad personalization in your Google settings. We use it for cross-device reports and to measure our marketing. Google may use its own cookies on Google domains for this.
You can see and control how Google uses your data at myadcenter.google.com.
How to change your choices
- On our site: click “Cookie settings” in the footer at any time. Your new choice applies right away.
- US residents: visit Do Not Sell or Share My Personal Information.
- Global Privacy Control: turn on GPC in a supported browser or extension, and we will honor it automatically.
- In your browser: you can delete cookies, local storage and session storage in your browser settings. Blocking strictly necessary items may stop sign-in or checkout from working.
- Provider tools: you can also use the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).
When you withdraw consent, analytics and marketing stop for future page views. Cookies already set by Google or Microsoft may stay in your browser until they expire or you delete them.
Changes to this policy
We will update this policy when we add, remove or change cookies or storage items, and we will change the “Effective date” above. If we add a new category that requires consent, we will ask you again.
Contact
Questions about cookies? Email contact@photoforpass.com.
HELPERG LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA