Talisman VisionOur lens standard

Talisman Vision

Cookies

The cookies and browser storage we use, what each one does and how long it lasts.

Last updated:

In short

Cookies on the public site

These cookies are set by talisman.vision. Scripts on the page cannot read them, and they are sent only over secure connections.

Purpose
Links this browser to the frame and lens pairings you saved. It holds a random code, not your name, your email address or the pairings themselves.
Set
When you first save a pairing to your basket.
Lasts
30 days from when it is set. Later visits do not extend it. Deleted when you sign out of a shopper account.
Type
Strictly necessary. The basket cannot work without it.
Purpose
Keeps you signed in to your shopper account. It holds a random code, and we store only a one-way hash of it.
Set
When you sign in with a link we emailed you.
Lasts
30 days. Deleted when you sign out.
Type
Strictly necessary for signing in.
Purpose
Reserved for a referral programme. Our referral programme is not running, so this cookie is not set. We will update this page before one starts.
Set
Never while the programme is not running. If you open an old referral link (an address starting with /r/) and your browser still has this cookie, we delete it.
Lasts
Not set.
Type
Not strictly necessary. It would be used only for referral rewards, never for advertising.

An earlier version of the site named the basket cookie galaxy-cart. If your browser still has it, we copy its code to talisman-cart and delete it the next time you change your basket.

Security check on the sign-in form

The sign-in form on the account page can show a Cloudflare Turnstile check, which tells people apart from automated programs. When it does, the check loads from challenges.cloudflare.com and runs in a frame from that address. talisman.vision sets no cookie and no browser storage for it. Cloudflare's Turnstile Privacy Addendum explains how the check processes data and states that the signals it collects are strictly necessary to detect and block bots. For cookies, it refers to Cloudflare's own cookie policy. Any cookie or storage the check uses belongs to Cloudflare's address, and we cannot read it. If the check cannot run in your browser, the form cannot send a sign-in link. When the form does not show the check, none of this applies.

Traffic statistics without cookies

Cloudflare Web Analytics adds a small script from static.cloudflareinsights.com to our pages. It counts page views and measures how fast pages load. Cloudflare states that it does not use cookies or local storage. We see only totals. You can block the script with a content blocker, and the site works the same without it.

Staff sign-in and the admin area

These apply only to people who sign in, or start to sign in, to our admin area at /admin.

Purpose
Keeps an editor or administrator signed in. It holds a signed code that matches a session record on our server.
Set
When a staff member signs in.
Lasts
12 hours from when it is set. Deleted on sign-out.
Type
Strictly necessary. Set by talisman.vision. Scripts cannot read it, and it is sent only over secure connections.
Purpose
Set by Cloudflare Access, which checks the administrator's identity. CF_AppSession protects the sign-in against forged requests from other sites. CF_Authorization shows that the administrator passed the check.
Set
CF_AppSession for anyone who starts the administrator sign-in at /admin/sso. CF_Authorization only after a successful check.
Lasts
The session length in our Cloudflare Access settings, 24 hours by default.
Type
Strictly necessary. Set by Cloudflare.

The admin editing screens also remember which panels are collapsed, in the browser's local storage. The keys are named talisman-cms:collapsed:global:<global>:<field> and talisman-cms:collapsed:collection:<collection>:<entry>:<field>. They are written when an editing screen opens, stay in that browser until cleared, and are never sent to us. If saving a new entry partly fails, for example it is saved as a draft but not published, the editor keeps the error message in that tab's session storage under talisman-cms:editor-notice:<collection>:<entry> until the entry opens, then deletes it.

Managing cookies

You can delete or block cookies in your browser settings. Without talisman-cart you can still browse the whole site, but the basket cannot remember your pairings. Without talisman-customer you cannot stay signed in.

Questions and changes

We update this page when we add, change or remove a cookie. The date at the top shows when it last changed. If you have questions, email privacy@talisman.vision. Our privacy notice explains how we handle personal data.