Legal
Cookie Policy
Last updated: 2026-07-28
This page lists every cookie and browser-stored value tryprimero.com uses. There are no advertising cookies and no cross-site trackers in the list, because we do not set any.
Everything here exists for one of three reasons: keeping you signed in, keeping the free try-on to one per device, or remembering that you have already seen a notice.
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| tp_session | Your signed-in session. httpOnly, so JavaScript cannot read it, and signed so a forged value is rejected. | 30 days |
| tp_auth | A readable flag that says "someone is signed in", used only so the header does not flicker while the real answer loads. It grants nothing on its own. | 30 days |
| tp_did | A random device id. Together with a coarse fingerprint it keeps the free try-on to one per device. | 400 days |
| tp_human | A signed token issued after you pass the Cloudflare Turnstile check, so you are not asked again during the same visit. | 45 minutes |
| tp_cookie_note | Remembers that you dismissed the notice at the bottom of the page, so it is shown once. | 1 year |
Values stored in your browser (not cookies)
| Name | Storage | Purpose |
|---|---|---|
| tp_did | localStorage | A copy of the device id, so clearing one of the two does not silently create a new device. |
| tp_signed_in | localStorage | Marks that someone signed in on this browser. It is what lets us avoid downloading the ~250 KB sign-in SDK for the majority of visitors, who never sign in. |
| tp_human | sessionStorage | A copy of the Turnstile token, so it also works in browsers that block third-party cookies. |
Identifiers we derive but do not store in readable form
To keep the free try-on to one per device and to stop the sign-in form being used to email strangers, our servers derive two more identifiers from each request:
- A hash of your IP address — salted and one-way. We never store the address itself.
- A hash of a coarse browser fingerprint — screen size, timezone, language, platform. Deliberately imprecise: it is enough to recognise the same device after a cookie wipe, and not enough to identify you across sites.
Both are used for rate limits and abuse prevention only, and the buckets they live in are deleted after 3 days.
Cookies set by others
Cloudflare serves this site and may set its own security cookies (such as __cf_bm and cf_clearance) to tell human traffic from automated traffic and to keep the site available. These are set by Cloudflare, not by us.
Stripe sets cookies on its own checkout page, which is where card payments happen. That page is Stripe’s, and so is its cookie policy — we never receive your card details.
Google Fonts serves the typefaces. Firebase (Google) handles sign-in and stores its session data in your browser once you sign in.
Managing cookies
Every browser lets you view, block and delete cookies from its settings. Blocking them here has a specific cost: you cannot stay signed in, and clearing the device id does not restore the free try-on, because it is also counted against the hashed IP and fingerprint pair described above.
How your data is used more broadly is set out in the Privacy Policy. Questions: [email protected].