Cookie Notice

ProperPics · Effective date: 30 September 2026

This notice explains the cookies ProperPics uses. We are the responsible party for the cookies set by this site. This website sets only first-party cookies: a strictly-necessary session cookie, which before you sign in may also remember the name of the campaign link you first arrived on; one functional cookie, nc, whose only job is to keep signed-in users' devices out of our own visitor count; and, if you arrive through a customer's referral link, a ref cookie that remembers whose link it was. None of them identifies you or follows you to other websites. We use no third-party analytics and no advertising cookies. Our Content-Security-Policy restricts scripts to our own domain, with one exception: the sign-up and password-reset pages load a check from Cloudflare, described below. We do keep our own count of visits to our public marketing pages; it uses no cookies and keeps nothing that identifies you, and it is described in our Privacy Policy, section 13.

What a cookie is

A cookie is a small text file a website stores on your device. Under POPIA, cookie data can be personal information because it may contain an "online identifier" (section 1).

Our legal basis, and why there is no consent banner

We process our cookies under the legitimate-interest grounds in POPIA sections 11(1)(d) and 11(1)(f), not under consent. The session cookie is strictly necessary: it is essential to deliver the secure, signed-in service you have asked for, and strictly-necessary cookies do not require your consent. The nc cookie is not strictly necessary, but it rests on the same legitimate-interest grounds: it stores only the value "1", contains no identifier, and is used for one thing, keeping our visitor statistics accurate by excluding devices that use the service; it cannot be used to track you. The ref cookie rests on the same grounds: it holds only a signed copy of the referral code in the link you followed, so that the customer who shared it can be credited if you sign up, and nothing about you. If you arrive through one of our campaign links (a link in one of our social media posts or adverts) before you sign in, the session cookie also keeps that campaign's name, on the same legitimate-interest grounds, so that a sign-up can be credited to the post that brought it. Nothing in it identifies you: the words are the campaign's, not yours. POPIA's openness condition (section 18) requires us to tell you about all of this, which is the purpose of this notice. No cookie we set identifies you, follows you to other websites or is used for advertising, so no cookie-consent banner is shown.

The cookies we set

NameSet byPurposeTypeDuration
session ProperPics (first-party) Keeps you securely signed in and protects against cross-site request forgery (the CSRF token is carried inside this same signed cookie). For a visitor who is not signed in, it also remembers the name of the campaign link (from one of our social media posts or adverts) they first arrived on, so that if they sign up, the sign-up can be credited to the post that brought it. Nothing in it identifies the visitor: the words are the campaign's, not theirs. It is HttpOnly, SameSite=Lax, and Secure in production. Strictly necessary (signing in and security); the campaign name rests on legitimate interest Signed in: expires after 2 hours of inactivity, and at most 12 hours after you sign in; cleared when you log out. Not signed in: up to 14 days from your last visit.
nc ProperPics (first-party) Set when you sign in. Its only purpose is to mark the device as one that uses the service, so that our own count of visitors to the public marketing pages (Privacy Policy, section 13) leaves it out. It stores only the value "1", contains no identifier, is read for no other purpose, and cannot be used to track you. It is HttpOnly, SameSite=Lax, and Secure in production. Functional (not strictly necessary; suppresses counting, never tracks) 12 months from your most recent sign-in. It deliberately remains after you log out, so the device stays excluded from the visitor count.
ref ProperPics (first-party) Set only when you follow a customer's referral link. It holds a signed copy of that link's referral code, so that if you sign up, the customer who referred you gets the referral credit. It contains nothing about you and is read for no other purpose. It is HttpOnly, SameSite=Lax, and Secure in production. Functional (referral credit; never tracks) 30 days from when you followed the link.

Cloudflare's check on sign-up and password reset

To keep automated sign-ups out, our sign-up and password-reset pages load a check called Turnstile from Cloudflare. No other page loads it. Your browser fetches Cloudflare's script, which sends Cloudflare your IP address, your browser details and similar technical signals, and Cloudflare may store information in your browser to run the check; when you submit the form, we also send Cloudflare your IP address to confirm the result. Cloudflare uses this to tell people from automated programs on our behalf, and also to improve its own bot detection. This is set by Cloudflare, not by us; see Cloudflare's Turnstile privacy addendum and our Privacy Policy, section 7.

We use htmx, a small JavaScript library served from our own domain, to update parts of a page. It is a script, not a cookie, and stores nothing that identifies you.

Managing cookies

You can block or delete cookies in your browser settings, but disabling the strictly-necessary session cookie will prevent you from logging in and using the service. Deleting the nc cookie does not affect the service at all; it only means that visits from your device to our marketing pages may be counted in our anonymous visitor statistics until you next sign in. You may object to this processing at any time, free of charge, by contacting us at privacy@properpics.co.za (POPIA section 11(3), as strengthened by the 2025 amendment Regulations).

No tracking, and a promise about the future

Our own cookies involve no third-party sharing and no cross-border transfer. (Cloudflare's check on the sign-up and password-reset pages is described above. The separate transfer of listing photographs to Google and OpenAI for image processing is covered in our Privacy Policy, section 8. That is not a cookie.) If we ever introduce a tracking, advertising or profiling cookie (for example Google Analytics, an advertising pixel or other third-party tracking), we will first show a consent banner that obtains your voluntary, specific and informed opt-in and blocks those cookies until you agree, and we will update this notice (POPIA sections 11(1)(a) and 69).