Cookies at the Workshop

Your choice

Choose Accept analytics or Reject analytics in the banner. Both choices are equally available. We do not start optional measurement before you accept. To change your choice or withdraw permission, use Cookie settings at the bottom of every page. Your choice lasts 180 days; we ask again when it expires or the consent wording changes.

Rejecting or withdrawing removes the optional browser identifier and stops future analytics. If you accept again after withdrawing, we create a new identifier. Your cookie choice is separate from email subscriptions.

Essential cookies

Santa’s Workshop and Supabase use first-party cookies for verified sign-in, email-code challenges, private pass access and email-preference sessions. These run only as those services require them. They keep your account or requested service secure; they are not used for advertising.

sw_cookie_consent remembers only your analytics choice, wording version and time for 180 days. It is set when you make a choice, even if you reject analytics.

Supabase sign-in cookies use names starting with sb- and follow your session and refresh rules. workshop-email-challenge lasts up to one hour. workshop-mailing keeps a verified email-preference session for 30 minutes. north-pole-pass keeps private pass access for up to 90 days after delivery. north-pole-print-order keeps private access to your printed-pass order for 90 days; it contains an order identifier and a secret access token, never card or address details. Logging out or using the relevant privacy controls clears access where applicable.

Stripe hosts payment checkout and may use cookies on its own checkout to process payments and prevent fraud. See Stripe’s cookie policy for those cookies. We do not load Stripe’s tracking scripts on this site.

Optional analytics

sw_analytics_id is a random identifier set by Santa’s Workshop only after acceptance. It lasts up to 180 days and helps distinguish browsers that accepted analytics. It is not your account ID, and we do not attach it to an email or family profile. sw_analytics_session groups accepted activity into a visit. It expires after 30 minutes without a measured event, with a maximum visit length of 24 hours, and is removed when you withdraw permission. The optional tab-local toy-show-homepage-entry marker attributes a pass start to a recent homepage click. It is consumed at the start, expires for attribution after 30 minutes and is cleared on withdrawal.

We send a limited set of events to PostHog’s EU service through our server: public page visits, story reading starts, PDF or EPUB download clicks, story-channel clicks, sign-in screen visits, code requests and successful sign-ins, letter-creation entry, interview and preview milestones, approvals and cart activity, pass steps and printed-pass offers, checkout starts or failures, and confirmed purchase returns. We record only the step and a fixed product label; cart views also say whether the cart is empty, ready or unavailable. Download clicks do not prove a download completed. Purchase-return metrics do not replace our payment records.

On public pages, we recognise a fixed list of source and medium labels in campaign links, such as Facebook, Instagram, TikTok, YouTube, Google, Bing, Spotify and newsletter traffic. We also recognise those services’ known referring domains. We send only approved labels and known domain names; unknown values, campaign names, referring page paths, complete query strings and fragments are discarded. Missing information stays unattributed.

We exclude children’s names, parent emails, family memories, form contents, private page URLs and payment references. We do not forward your connection’s IP address or browser user-agent to PostHog. We do not use session recordings, advertising cookies or automatic collection of clicks and form contents.

Withdrawal does not delete events already collected. PostHog is our event analytics service provider. More information is available in PostHog’s privacy policy.

With the same permission, Vercel Web Analytics measures visits to our public pages. It does not set analytics cookies, and we do not include our PostHog browser or visit identifiers in Vercel analytics events. Vercel derives a short-lived visitor hash from the connection and browser information and reports aggregate page views, referrer origins, approximate location, browser and device information. We remove URL queries and fragments and exclude private pages. We send no custom events to Vercel. See Vercel’s analytics privacy information.

Browser controls and questions

You can also delete or block cookies in your browser. Blocking essential cookies can prevent sign-in or private access from working. Deleting the consent cookie makes us ask for your choice again.

For questions or a privacy request, email privacy@santasworkshop.ie. See our privacy policy for how we use the details you provide.