Cookie policy

This policy explains what WorkHeadshot stores on your device. It covers cookies and similar storage, including small preferences kept in this browser.

We use one first-party cookie for the service.

• Name: wh_session.
• Purpose: remembers a random id for your headshot balance, plan, sign-in, saved headshots, and the path from a visit to checkout. This measurement stays on WorkHeadshot. It is not advertising.
• Duration: 180 days.
• When it is set: when you browse the site, open your account, check your balance, start checkout, or make a headshot.
• Contents: a random id. Not your name, email, or photo.
• Flags: httpOnly, so scripts on the page cannot read it. SameSite=Lax. On the live site it is sent only over HTTPS.

The cookie is required for the account, the balance, and sign-in. The same cookie also lets us count visits and the steps toward checkout, so we can see where people stop. We do not use it for advertising, and we do not share it with an ad network. Choosing OK records that you saw this notice.

Cloudflare hosts the site and may store a short-lived security cookie, or process your IP address, to protect the site from abuse. That is part of delivering the site. It is not advertising.

We remember three choices in local storage on this device. They are not sent to us as cookies.

• That you closed the cookie notice.
• That you closed the plan bar at the bottom of the page.
• Whether you chose the dark or light theme.

We do not use advertising cookies or social-media pixels. We do not let other companies set marketing cookies through this site. Flag images in the short example notices are files on our own site. Visit counts are stored with the necessary cookie, not with a separate analytics cookie.

You can delete cookies and site data in your browser settings. If you block the necessary cookie, this browser cannot keep your balance. Sign in with your email before you switch browsers if you want the balance to follow the email. A browser that blocks all cookies also cannot stay signed in.

The full account of personal data is in the privacy notice. How to use your rights is on the GDPR page.