Cookie Policy

What cookies we use

Shop-OS uses only strictly necessary cookies. These are required for the service to function and cannot be disabled. We set no analytics cookies, no marketing cookies, and no third-party cookies — on the marketing site (shop-os.app) we set no cookies at all.

Session cookies

When you sign in to the Shop-OS app, Auth.js sets a session cookie to keep you authenticated. This cookie expires after 24 hours (8 hours for admin users). It contains no personally identifiable information beyond an encrypted session token.

CSRF tokens

Auth.js also sets a CSRF token cookie to protect against cross-site request forgery attacks. This is a security requirement and cannot be disabled.

Analytics — without cookies

We measure traffic on the marketing site using Plausible Analytics, self-hosted on our own EU/UK infrastructure. Nothing leaves our servers, and no third party receives your data.

Plausible works without cookies and without personal data. It sets no cookies, uses no browser storage, and creates no persistent identifier for you or your device. It does not track you across sites or across devices. Your IP address and browser details are not stored: they are used only transiently to distinguish one visit from the next within a single day, via a salted hash that is discarded and re-salted every 24 hours. What we keep is aggregate counts — page views, referrers, countries, device types — never a profile of you.

Because this involves no cookies and no comparable storage on your device, it does not require consent under PECR, and you will not see a cookie banner for it.

No consent banner needed

Because we set only strictly necessary cookies, we are not required under PECR to show a cookie consent banner. If we ever introduce cookies that need your consent, we will update this policy and add a consent mechanism first.

Contact

For any questions about cookies, contact privacy@shop-os.app.