Cookie Policy

A cookie is a small text file your browser stores on your device when you visit a website. We also use related technologies (localStorage, sessionStorage) for similar purposes; for brevity we refer to all of these as “cookies” below.

We use the cookies necessary to deliver the Service, a small number of functional cookies for security and error monitoring, first-party product analytics (PostHog), and Google Analytics on the public marketing site (with consent in the EEA / UK). We do not use advertising cookies.

2.1 Strictly necessary

• better-auth.session_token / better-auth.session_data — the Better Auth session and its HMAC cookie cache. Required to keep you signed in. First-party, SameSite=Lax, scoped to the parent zone in production. Session lifetime is 7 days.
• fs_ws — the active workspace id so pretty URLs resolve without an extra lookup.
• frameshot-sub — a 60-second HMAC-signed cookie that lets the edge middleware verify your subscription state without a database round-trip on every navigation. First-party, HttpOnly, SameSite=Strict.
• cf_clearance / __cf_bm — Cloudflare security cookies set during bot challenges. Set by Cloudflare, not by Frameshot. Required for the Service to be reachable.
• sb-*-auth-token — leftover hosted-Auth cookies from before Better Auth. They do not authorize requests. They are evicted after you sign in.

2.2 Functional

• Sentry session-replay (when enabled) — error-monitoring identifiers used to correlate stack traces with the user-visible error. Personal data is scrubbed before transmission. Disabled in development; subject to our redaction layer in production.
• localStorage: zustand stores — UI state such as the current canvas view, recent prompts, and the timeline scrub position. Stays on your device; not transmitted to our servers.
• localStorage: PostHog — a first-party anonymous id so product events (pageviews, signup, generation) stitch across a session. No third-party cookies. Browser traffic is proxied through our own /ingest path. Prompts and media URLs are not sent.

2.3 Analytics

• Google Analytics 4 (_ga / _ga_*) — first-party cookies set by Google on the public site (frameshot.ai, TV, University, auth) so we can see which marketing pages are used. Not loaded on app.frameshot.ai. In the EEA / UK the tag is not injected until you tap Accept on the cookie notice. You can refuse with Necessary only.
• PostHog — product analytics for the logged-in app and marketing funnel (pageviews, signup, generation, billing). Hosted in the EU. Distinct id is your Frameshot account id after you sign in.

2.4 What we do NOT use

Frameshot does not set advertising cookies, embed third-party social-network trackers, or use cross-site retargeting pixels.

Most browsers let you delete cookies, block them by site, or warn before storing them. Disabling strictly-necessary cookies will sign you out of Frameshot and may break parts of the Service. Browser instructions: Chrome · Firefox · Safari.

When we add or remove cookies, we update this page. The “Last updated” date at the top of the page reflects the most recent change.

Questions about cookies? privacy@frameshot.ai.