Cookies & tracking
Last updated: 2026-06-10
This page explains what cookies and similar technologies (such as localStorage and sessionStorage) Pixto uses, why we use them, and how you can manage your choices.
1. Categories we use
We group cookies and similar identifiers into four categories, matching the EU ePrivacy framework:
- Strictly necessary. Without these the Service cannot function. They cannot be switched off in our consent banner. Examples: authentication session, anti-CSRF token, locale preference set by the i18n middleware.
- Preference. Remember non-critical choices you made, such as whether the studio sidebar is collapsed or which locale you last picked. Set only after page-by-page use of the interface.
- Analytics. None today. If we add a product analytics tool in the future it will only fire after you opt-in via the cookie banner, and this page will be updated.
- Marketing. None today. We do not run an ad network and we do not share data with third-party advertisers.
2. Full cookie & storage table
The table below lists every cookie and persistent client-side identifier the Service actively sets.
| Name | Type | Purpose | Retention | Party |
|---|---|---|---|---|
| next-auth.session-token | Strictly necessary | Keeps you signed in. Required for any logged-in surface of the Service. | 30 days (rolling) | First-party |
| next-auth.csrf-token | Strictly necessary | CSRF protection for authentication endpoints. | Session | First-party |
| NEXT_LOCALE | Strictly necessary | Remembers the language you chose so we can render the site in your locale. | 1 year | First-party |
| pixto.cookie_consent | Strictly necessary | Records your cookie-banner choice so we don't ask again on every page load. Stored in localStorage, not as an HTTP cookie. | Until cleared | First-party |
| pixto.sidebar_collapsed | Preference | Remembers whether the studio sidebar is collapsed. | Until cleared | First-party |
| __cf_bm, cf_clearance | Strictly necessary | Set by Cloudflare for bot-management and DDoS protection at the edge. | 30 minutes – 1 year | Third-party (Cloudflare) |
We do not load any third-party advertising, social-tracking or product-analytics scripts at the time this page was last updated.
3. Managing your choices
You can change your choice at any time by clearing the pixto.cookie_consent entry from your browser's site-data storage — on next page-load our banner will ask you again.
You can also block or delete cookies from your browser settings. The links below open the instructions for the major browsers:
Note that blocking strictly-necessary cookies (such as the session and CSRF tokens) will prevent you from signing in.
4. Related policies
For the wider context of how we handle personal data, see our privacy policy and the GDPR rights page.