Cookies
Last updated: 29 October 2026
DRAFT — NOT YET IN FORCE. A practising Irish solicitor or privacy adviser should review this policy before publication. It describes what the code set on 27 October 2026; re-check it whenever analytics, chat, embeds or marketing tools are added.
The short version
Our websites use no tracking or advertising cookies. The app uses only the cookies it needs to sign you in and keep you secure. If we ever add optional cookies, they will stay off until you say yes.
Cookies are small text files a website stores in your browser. "Local storage" is a similar browser feature. Under the Irish ePrivacy Regulations (S.I. 336/2011, Regulation 5), a site needs your consent to store or read them, unless they are strictly necessary to provide a service you asked for.
1. Our websites (grafkit.com, grafkit.ie, grafkit.ca)
Our websites set no cookies of their own. They run no analytics, advertising, tracking pixels or chat widgets.
- Your cookie choice. When you first visit, a small notice explains this. Your answer is saved in your browser's local storage as
gk-consent(the choice, its date and the policy version) so we don't ask again. It is not a cookie and is not sent to us. It lasts 6 months, or until we change this policy. This is allowed without consent, because it is needed to remember your choice. - If we add optional cookies (for example analytics), the notice will ask first. "Accept all" and "Reject all" will be equally easy, nothing optional will load before you choose, and the website will keep working whatever you pick.
- Change your mind at any time with the Cookie settings link at the foot of every page.
- Google Fonts. Our pages load fonts from Google's servers. Your browser asks Google for the font files, which shares your IP address and browser details with Google. Google Fonts does not set cookies.
- Cloudflare. Our sites are delivered through Cloudflare. In some cases, such as suspected bot traffic, Cloudflare may set a strictly necessary security cookie (for example
__cf_bmorcf_clearance) to tell people from bots. These do not track you across sites.
2. The Grafkit app (app.grafkit.com)
The app uses only strictly necessary cookies and local storage. We do not need your consent for these, but we tell you what they are.
| Name | Type | Purpose | How long |
|---|---|---|---|
__Host-grafkit.session_token (and related __Host-grafkit.* cookies) | Cookie, first-party, secure, HTTP-only | Keeps you signed in and protects against forged requests | Up to 30 days; renewed when you use the app; deleted when you sign out |
gk_guest | Cookie, first-party, HTTP-only, limited to one shared link | Lets a guest you invited view and comment on a specific piece of work without an account | Until the guest link expires |
gk-theme | Local storage | Remembers whether you chose light or dark mode | Until you clear it |
| Brand book password cookie | Cookie, first-party, secure, HTTP-only, signed, limited to one link | Set only when you enter the correct password for a password-protected shared brand book or guidelines link, so you don't have to re-enter it on every page | 12 hours |
| Brand book view check | Session storage | On a shared brand book or guidelines link, stops the same page being counted twice in one browser tab. Holds no identifier | Until you close the tab |
Cloudflare may also set the security cookies described above.
3. Checkout
When you pay, you go to a checkout page hosted by Stripe (checkout.stripe.com). Stripe sets its own cookies there, for fraud prevention and to make payment work. Those are covered by Stripe's cookie policy at stripe.com/cookies-policy/legal.
4. Managing cookies
You can block or delete cookies in your browser settings. If you block the app's cookies, you will not be able to sign in.
5. Changes
If we ever add cookies or scripts that are not strictly necessary, such as analytics, marketing-tool tracking or embedded video, we will ask for your consent first, before they are set. "Accept" and "Reject" will be equally prominent, consent will be as easy to withdraw as to give, and we will update this policy, in line with the Data Protection Commission's guidance on cookies.
6. Contact
[email protected] — see our Privacy Policy.
Terms · Privacy · Cookies · Sub-processors · Company details · Accessibility ·