Cookie Policy
Which cookies and browser storage we use, why, for how long - and how to change your choice.
Last updated October 15, 2026.
What cookies are
Cookies are small text files a website stores in your browser. Local storage and session storage do a similar job without being sent to the server on every request. This policy covers all of them, and calls them “cookies” for short.
How we use them
We use two kinds. Strictly necessary cookies make the site work: signing in, keeping your work while you build a theme, protecting forms from abuse, and remembering your cookie choice. The law lets us use these without asking, because the site cannot do what you asked for without them.
Analytics help us see where people get stuck. We only use them if you say yes. They are first-party: the records stay in our own database, they are never shared or sold, and they are never used for advertising. We use no advertising cookies and no third-party analytics.
Analytics here means the usage events your browser sends us, such as uploading a logo or reaching the paywall. Separately, our servers record four events as part of running the service: that an account was created, that a checkout was started, that a payment was received and that a package was downloaded. They set no cookie, they are kept for 180 days, and they are recorded whatever you choose in the banner, because the service would not work without keeping its own record of them.
Your choice
The first time you visit, a banner asks you to Accept all, Reject all, or Manage preferences. Until you choose, analytics stay off. We remember your answer for 12 months, then ask again, and we also ask again if we ever change what a category covers.
You can change your mind at any time, here or from Cookie settings at the bottom of every page. Turning analytics off stops new records from that moment. You can also delete or block cookies in your browser settings, but blocking the strictly necessary ones will stop sign-in and saving from working.
Strictly necessary (always active)
Needed for the site to work: signing in, keeping your work while you build a theme, protecting forms from abuse, and remembering your cookie choice. These cannot be switched off.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Sign-in cookieonce you sign in | Cookie | Keeps you signed in. | 30 days, renewed while you use the site |
| Form security cookie | Cookie | Stops other websites from sending our sign-in forms on your behalf. | Until you close your browser |
| Sign-in return cookie | Cookie | Remembers which page to return you to after signing in. | Until you close your browser |
| Google sign-in cookiesonly while signing in with Google | Cookie | Keep your Google sign-in safe while you are sent to Google and back. | 15 minutes, or until you close your browser |
| Draft cookie | Cookie | Links the logo and colours you are working on to a saved draft before you have an account, so nothing is lost on reload. If you accept analytics, it is also the anonymous id your product-usage events are recorded against. | 7 days |
| Your cookie choice | Cookie | Remembers your cookie choice, so we do not ask on every page. | 12 months |
| Browser IDonce you ask for a sign-in link or set up your account | Local storage | A random id for this browser, used to slow down fake sign-ups. Nothing about your device is read to make it. | Until you clear your browser data |
| Refinement in progresswhile a refinement is running | Session storage | Picks a running theme refinement back up if you reload the page. | Until you close the tab |
| Checkout returnduring checkout | Session storage | Returns you to your work after checkout. | Until you close the tab |
Analytics (only with your consent)
Help us understand where people get stuck, by recording a few product-usage events (for example "uploaded a logo" or "reached the download screen"). First-party only: kept in our own database for 180 days, never shared, never used for advertising.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Product-usage events | Server record | A short record of moments like uploading a logo or reaching the paywall, linked to the draft cookie or to your account. No cookie of its own: nothing is recorded unless you accept analytics. | 180 days |
Other companies’ services
Two services we rely on load inside their own frame, from their own website, and may set their own cookies there. We do not control those cookies. Each company’s own notice describes them.
- Cloudflare Turnstile - Checks that a form is being filled in by a person, not a bot. Used on: The sign-in, support and "tell me when it is ready" forms. Cloudflare Turnstile privacy notice
- Paddle - Takes the payment. Paddle is the merchant of record for every purchase. Used on: The checkout page. Paddle privacy notice
These are needed to protect sign-in and to take payment, so they load whatever you choose in the banner.
More about your data
For what we collect beyond cookies, who processes it and your rights, see our Privacy notice.