Cookie Policy
Updated 3 November 2026 · Draft for operator and professional review before paid launch
Nelly's Hart is a trading brand. Legal operator details are awaiting confirmation; paid launch is not approved. Contact: info@nellyshart.co.uk.
Storage used by the service
The Studio uses IndexedDB for device projects and image data. Parent authentication uses browser storage for the session. The published domain was observed setting Cloudflare's __cf_bm security cookie, with an expiry about 30 minutes later, for bot/security protection. Stripe can use payment/security cookies or storage when checkout loads; authenticated checkout storage is not yet fully audited. We do not receive complete card details. Google Fonts and hosted media generate external requests. No advertising or analytics integration was found in the application source; hosting telemetry and payment-provider storage still require published-site review. This is not a guarantee that no third-party cookie ever exists.
Necessary and optional storage
Working copies and login/security storage support services you request. Optional remembered school referrals use the nh_school browser key only after an affirmative choice. A small school-preference record remembers acceptance or rejection; reject is as accessible as accept. The code supports fundraising attribution, not advertising. It must not be treated as strictly necessary merely because it helps fundraising.
Your choices
The school-referral prompt appears when a code is offered and you have not chosen. You may reject persistence and still enter a code manually at checkout. Use School referral preferences below to withdraw or change your choice; withdrawing clears the remembered code, not prior lawful purchase records. Clear your browser's site data to remove local copies and sessions. This can erase your only working book copy, so save purchased PDFs first.
Consent before new tracking
A general accept-all banner is not added for an application with no deliberate advertising/analytics integration. Any non-essential tracking found in the production/provider review must be blocked until valid consent, with rejection and withdrawal. Payment/security storage exemptions must be assessed against actual purposes; this policy does not certify PECR compliance. The operator must review third-party runtime behaviour before launch.
Questions or rights requests: info@nellyshart.co.uk.