Legal · Natali Kornata
Privacy Policy
What data we collect
This site collects limited data to deliver its service and, with your consent, to understand how visitors use it:
- Analytics data (page views, interactions), collected only with your explicit consent.
- A session token when you access a private client gallery via a magic link.
- Functional preferences (language, color theme) stored in first-party cookies.
- Contact details (name, email) provided voluntarily when collecting or downloading photos from a private gallery.
Analytics & consent
Analytics storage and interaction beacons are OFF by default. They are only activated if you explicitly click Accept on the consent banner.
When analytics is enabled, each page view also records: the page you visited, an approximate location (your country, region and city, determined on our server from your network connection, we never store your IP address), your device type, browser and operating system, your screen and window size, the site that referred you, and your language, time zone and connection type. All of this is linked only to the random analytics identifier described below, never to your name or email, and is used only in aggregate to understand how the site is used. It is deleted automatically after 24 months.
If you click Decline, or if you close the banner without making a choice, no analytics identifier is stored and no data is collected about your visit.
You can change your choice at any time using the Cookie settings link in the site footer. The cookie records your decision for up to 12 months, after which you will be asked again.
Private gallery access (strictly necessary)
When you open a private client gallery via a magic link, a strictly-necessary session cookie is set. This cookie authenticates your session and is required for the gallery to function. It expires after 30 days or when you close your browser, and is never used for advertising or analytics.
Cookies and local storage
The following table lists the cookies and browser storage this site may use, their purpose, and whether they require your consent.
| Name | Purpose | Duration | Category |
|---|---|---|---|
locale-override | Remembers your preferred display language. | 1 year | Functional (no consent required) |
theme | Remembers your preferred color theme (light / dark / system). | 1 year | Functional (no consent required) |
consent | Records your analytics consent choice (granted or declined). Strictly-necessary for the consent gate to function, not an analytics cookie. | 12 months | Strictly necessary |
nk_anonlocal storage | Stores a random analytics identifier (no personal data) in your browser's local storage to count page views and interactions, plus a per-session marker so the same gallery is not counted twice. Created only after you grant analytics consent, and removed if you withdraw it. | Until you withdraw consent | Analytics (consent required) |
__session | Authenticates your private gallery session after opening a magic link. httpOnly, strictly necessary. | 30 days | Strictly necessary |
Data retention & your rights
We keep personal data only as long as necessary:
- Analytics event data (views, downloads, shares): 24-month rolling window, then anonymised or deleted.
- Magic-link session tokens: 30 days.
- Admin sessions: 12 hours.
- Aggregated zoom-attention data (no personal identifiers): kept indefinitely.
- Deleting a gallery or visitor record triggers cascade deletion of all associated events.
You have the right to request access to, correction of, or erasure of your personal data. Contact us using the details below.
Third-party processors
We share limited data with the following processors who help deliver our service:
- Anthropic (US), Processes the English-language About page text to generate translations and clarity suggestions. Only admin-authored content is sent, no visitor personal data. Governed by Anthropic's data processing terms.
- Resend (US), Sends transactional emails (magic-link gallery invitations, admin password reset). Email address only; no other personal data. Governed by Resend's privacy policy.
Contact & erasure requests
For privacy questions or data-subject requests (access, correction, or erasure), you can reach us at ceo@wolfsteno.com.
Erasure requests will be processed within 30 days. Cascading deletion removes all associated event and session records.