Cookie Policy

This policy explains what CreArt stores on your device and why. The first part covers the website at creartai.com; the last section covers the mobile app, which does not use cookies but does use device identifiers.

Cookies and similar technologies

Cookies are small text files a website stores on your device. Browsers offer other storage of the same kind — localStorage and IndexedDB — and this policy covers those too, because from your point of view there is no difference: it is data kept on your device between visits.

What the website stores

Strictly necessary

Required for the site to work; they cannot be switched off from within it.

Firebase Authentication keeps your sign-in session in your browser (IndexedDB, "firebaseLocalStorageDb") so you are not signed out between pages. It appears only once you sign in.

Google reCAPTCHA Enterprise sets its own cookies through Firebase App Check. It is what stops the generators being driven by scripts, and it runs on every page that can reach them. These cookies are set by Google and governed by Google's privacy policy.

If you are an operator of the site, signing in to the admin area sets "creart_admin_session": a signed, HTTP-only cookie that expires after 12 hours. Ordinary visitors never receive it.

"creart.fingerprint" (localStorage) holds a device identifier we calculate to apply the free daily allowance to people generating without an account. Without it, clearing site data would reset the allowance indefinitely and we could not offer free generations at all. It is deliberately designed to survive private browsing. We delete our copy after 7 days without activity; yours goes when you clear this site’s data. The Privacy Policy explains it in full.

Functional

These remember choices you make. The site works without them; it simply forgets your preferences.

"lang-pref" stores the language you chose, so the home page opens in it next time. "creart.topbar.*" keeps the last known state of the top bar — your initial, avatar and credit balance — so it does not flicker while the page loads. "creart:brand-kit" and "creart:brand-assets" keep the colours, fonts and logo you set for the ad tools. "creart:local-generations" keeps a local list of what you generated before signing in, so it is not lost. "creart.comprasWeb.v1" remembers for up to a week a checkout you opened on the website, so that a completed purchase is counted once even if you close the tab before it finishes; it only reaches our analytics if you accepted analytics. In sessionStorage, "creart.homeComposer.inputImage" holds the photo you attached on the home page so it survives moving to a tool; "creart.assets.respaldo" remembers for five minutes whether our image server can be reached from your connection, so that images load through our backup address when it cannot; and other entries starting with "creart" keep what a page has already loaded — your credit balance, the community feed, the creation you were viewing, a checkout in progress — so it is not fetched again. Everything in sessionStorage is cleared when you close the tab.

Analytics

We use Vercel Analytics and Vercel Speed Insights to count page views and measure loading performance. Neither sets cookies, and neither builds a profile of you or follows you across sites.

If you accept analytics in the banner, we also load PostHog (hosted in the European Union), which measures how the site is used and records browsing sessions — pages, clicks and interface behaviour. Text you type is masked and not recorded. It stores a "ph_*" cookie and matching localStorage entries to recognise the same session, and your answer to the banner is kept in "creart-analytics-consent" for 180 days. Nothing of PostHog is downloaded before you accept, a refusal is remembered and not asked again, and you can withdraw consent from the link in the footer.

With the same consent we also load Google Analytics 4 (Google Ireland Limited), which counts the pages you visit and what you do on them, such as starting a creation or completing a purchase. It sets the cookies "_ga" and "_ga_SV2KME0XR5", which recognise your browser for up to two years, and, if you are signed in, it receives your CreArt account identifier so that the website and the app count you as one person. Nothing of Google Analytics is downloaded before you accept, and the link in the footer withdraws your consent for it too.

The website carries no advertising and no cross-site tracking. Analytics — PostHog and Google Analytics — never load until you agree to them.

Third parties your browser contacts

Fonts are served from our own domain, not from a third party. If you buy a subscription or credits on the website, you pay on Stripe's payment page, under its own policies (subscriptions started before 15 September 2026 are handled by Paddle). Generated images are stored on Cloudflare R2 and delivered through links that expire.

The mobile app

The app does not use cookies, but it does use your device's advertising identifier — IDFA on iOS, Advertising ID on Android — for advertising and to measure which campaigns bring people to CreArt. This involves Google AdMob and Meta.

On iOS, personalised advertising requires your permission through Apple's App Tracking Transparency prompt, and you can change your answer under Settings › Privacy & Security › Tracking. On Android you can reset or delete your Advertising ID under Settings › Google › Ads. Buying a paid plan removes the ads.

The app also stores your sign-in session, your preferences, and a push notification token if you allow notifications.

Controlling what is stored

Every browser lets you view, block and delete cookies and site data, usually under privacy settings. Blocking the strictly necessary items above will sign you out and may stop the generators working; blocking the functional ones only means your preferences are forgotten.

Because the website sets no advertising cookies, the only choice to make here is the analytics one in the banner, which you can change at any time from the footer.

Changes to this policy

We update this page when what we store changes, rather than on a schedule.

Last updated: 8 October 2026.

Contact

Questions about anything on this page: yawaiapps@gmail.com.