Cookie policy

1. Cookies and browser storage

We use cookies and browser storage to remember your cart and choices. Some entries are sent with requests to the site, and others stay in your browser. The sections below explain the main customer-facing entries and the separate analytics settings.

2. Your cart, contact, design and login

lr-cart stores your cart in local storage so it survives a reload. If you give us an email and cart recovery is enabled, a snapshot of your cart and contact details can be sent to our server before checkout. This supports cart recovery and, when enabled, reminder emails. See the privacy policy for server-side records.

lr-contact remembers the artwork contact details you enter. They can be attached to your cart lines and sent when you order or when a cart snapshot is saved. Local storage remains until it is cleared or replaced.

lr-design-doc stores your current editor layout in session storage for that browser tab. Your source logo may need to be reattached after a reload. When you add a design to the cart, the manufacturing artwork is uploaded separately to private storage.

lr-design-previews keeps up to ten small design previews in local storage for cart review. These previews are not sent with checkout or cart-recovery requests. Previews older than 30 days are no longer shown, and old entries are removed when a new preview is saved.

lr-code holds a discount-link reference in session storage while you browse. Session storage normally clears when you close the tab.

lr-account keeps you logged in to your account in this browser. It holds a random reference to your login that only our server can check, and scripts on the page cannot read it. lr-signed-in holds only the date of your last visit, so the page can show that you are logged in. Both are strictly necessary, so they do not depend on your analytics choice. They last about 400 days from your last visit and are renewed when you come back. Logging out removes both.

lr_checkout and lr-buyer are set when you start checkout. lr_checkout names the checkout you opened, so starting checkout again with the same cart picks up the same one instead of creating a second order. It lasts an hour. lr-buyer is a one-time proof that this browser opened that checkout, so it can be logged in to the email on the order once you have paid. It is sent only to our account service, works once and lasts a day. Scripts on the page cannot read either of them. Both are strictly necessary, so they do not depend on your analytics choice.

3. Your preferences

lr-currency remembers the currency you choose. lr-country supplies an initial delivery country, and lr-units remembers metric or imperial measurements. These cookies last for 30 days and can be refreshed by a new choice.

lr-region remembers the country or region you pick in the region picker. It keeps you on that site, even when your location suggests another one. It lasts one year.

lr-cookie-consent stores whether you accepted or rejected analytics cookies. lr-consent-region tells the site, from the request’s approximate country, whether to show an initial consent panel and whether to ask before recording a visit. The region cookie lasts 30 days. When the country is unavailable, the site asks first.

lr-design-colours-v2 remembers, in local storage, that you hid the colors that mark your design in the design editor. It stays until you show them again or clear site storage.

lr-design-print-colours remembers, in local storage, that you turned on the colors in the design editor's Print view, where they start hidden. It stays until you hide them again or clear site storage.

These preferences and cart functions are separate from analytics and remain available when you reject analytics cookies.

4. Stripe checkout

Payment takes place on Stripe’s hosted checkout, where Stripe uses cookies for payment, security and fraud prevention. Stripe’s own privacy and cookie policies apply on those pages.

5. Analytics

Optional analytics follows the cookie banner. In the EEA, UK and Switzerland it starts only after you accept. Elsewhere it starts on unless you turn it off in cookie settings. GA4 measures traffic and acquisition. PostHog EU stores behavioral events. Rolly stores a minimal visitor and session index, approximate location, acquisition and consent information. The original source of a visit is retained separately from later visits. Unknown traffic is not assumed to be direct.

lr-cookie-consent remembers your analytics choice and lr-recording-consent your recording choice. The lr-visitor cookie is a random signed browser identifier lasting up to 180 days. lr-journey expires after 30 minutes of inactivity. Consent refusal, cleared storage, blockers and separate devices create gaps. Google _ga cookies follow the property’s configured retention.

When session recordings run, under the rules described in this section, PostHog receives recordings of public pages and heatmap activity. A recording shows the page as you saw it, including its text, what you type into forms, images, uploaded logos and the Designer canvas. Passwords are always masked. Private pages, the contact form and payment pages are not recorded. Network bodies and console contents are not recorded. Outside recordings, we never send entered design text, artwork, names or email addresses as behavioral analytics.

A confirmed purchase may associate its originating session with a customer record privately in Rolly. This is not proof of identity and does not automatically link later visits or other devices. Google Search Console supplies aggregate search queries. These cannot reliably be assigned to individual visitors.

Recordings expire after 30 days. Identifiable visitor history is retained for up to 12 months, and anonymous daily counts for up to 24 months. Temporary delivery records expire after 24 hours. Free-service limits may cause unrecoverable collection gaps.

Global Privacy Control turns off recordings and Rolly visitor history everywhere, and other optional analytics unless you accept it in the cookie banner. Withdrawing consent stops collection, clears optional identifiers and requests deletion of the current browser’s retained Rolly and PostHog history. Provider deletion can take time. Required order records remain. You can also request access or deletion at support@rollyme.com. No fingerprinting or advertising audiences are used.

When analytics cookies are allowed, Rolly also keeps its own visit log on our servers. The lr-jv cookie is a random browser identifier lasting up to 180 days. It records which pages of the shop you open, how long you actively spend on each, and moments such as adding to the cart, opening the designer, starting checkout and paying. It never records what you type. When you enter your email in the cart, check out or pay, the log is linked to that email so we can see how you found and used the shop. It stays with us and is not shared with analytics or advertising companies. It is deleted 12 months after your last visit, or straight away when you reject analytics cookies with the button below. If that deletion cannot finish at once, an lr-jv-erase cookie holds the identifier until your next page view completes it. Global Privacy Control turns the visit log off.

6. Change your choice

Use the Cookie settings button below to review or change your analytics choice. You do not need to delete your cart or contact details to do this. If browser storage is blocked, your choice applies to the current tab but may need to be made again after a reload.

You can also delete or block cookies and browser storage in your browser settings. Clearing site storage removes saved carts, contact details, design previews and preferences from that browser, and logs that browser out of your account. It does not delete an order or other record already sent to our server. Contact us for that request.

7. Questions and updates

We update this policy when the way the store uses storage changes. For a question about cookies or personal data, email support@rollyme.com.