Cookie Notice
Version 1.0 · Effective September 19, 2026
This Cookie Notice explains how Canvas Marketplace Inc. (“Canvas”, “we”, “us”) uses cookies and similar technologies on canvasugcmp.com and any other site we control that links to this notice (the “Sites”). It is part of our Privacy Policy.
The Sites use only strictly necessary cookies: one that keeps you signed in, one used briefly during two-factor sign-in, and security cookies set by Cloudflare. There are no analytics, advertising, social-media or session-replay cookies, which is why the Sites show no cookie banner. Because these cookies are essential, they do not require consent under laws that regulate non-essential cookies.
01 / What cookies are
Cookies are small text files a website stores on your device so it can recognise your browser on later requests. Session cookies expire when you close your browser; persistent cookies last until a set date or until you delete them. First-party cookies are set by the site you are visiting; third-party cookies are set by another domain, for example a payment provider’s page embedded in or linked from ours.
02 / Cookies we set
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
canvas.session_token | Identifies your signed-in session. Without it you cannot use your account. | Essential, first-party, HttpOnly, Secure, SameSite=Lax (production cookies carry the __Secure- prefix) | 7 days from your last daily activity; cleared on sign-out |
canvas.two_factor | Carries the pending sign-in while you enter a two-factor code. | Essential, first-party, HttpOnly, Secure | Minutes; removed once the code is verified |
__cf_bm | Cloudflare bot management. Distinguishes humans from automated traffic to protect the Sites. | Essential, set by Cloudflare on our domain | Up to 30 minutes |
cf_clearance | Records that you passed a Cloudflare security challenge, if one was shown. | Essential, set by Cloudflare on our domain | Up to a few hours |
03 / Cookies set by others
- Cloudflare Turnstile (challenges.cloudflare.com). The human-verification widget on the sign-up page runs in a frame from Cloudflare and may set cookies on Cloudflare’s domain to complete the check. Cloudflare’s privacy policy is at cloudflare.com/privacypolicy.
- Stripe (checkout.stripe.com, connect.stripe.com). Brands paying for wallet top-ups and creators onboarding for payouts are sent to pages hosted by Stripe, which set Stripe’s cookies for fraud prevention and to operate its pages. Stripe’s cookie policy is at stripe.com/cookies-policy/legal.
We do not embed any other third-party content, scripts or fonts on the Sites; fonts are served from our own domain.
04 / What we do not use
- No analytics cookies or scripts (no Google Analytics or similar).
- No advertising, retargeting or attribution cookies or pixels.
- No social-media login or sharing widgets.
- No session-replay or heat-map tools.
- No tracking pixels in the emails we send.
- No browser local storage, session storage or IndexedDB for tracking.
If we ever add any of these we will update this notice first and, where the law requires, ask for your consent before they run.
05 / Other technologies
Uploads of screenshots and rights files are made directly from your browser to a private storage bucket using a short-lived signed URL; this involves no cookies. We keep short-lived rate-limit counters on our servers, keyed by IP address or account, that are not stored on your device.
06 / Your choices
- Browser settings. Every major browser lets you view, block and delete cookies. If you block our session cookie you will not be able to sign in. Instructions: Chrome, Safari, Firefox and Edge each publish them in their help centres.
- Sign out. Signing out deletes your session cookie immediately.
- Do Not Track and Global Privacy Control. We set no cookies that these signals are designed to stop, so nothing changes when they are on. We treat a Global Privacy Control signal as an opt-out request wherever the law gives it that effect.
07 / Changes
We may update this notice when the Sites change. The version and effective date are at the top of the page. See the Privacy Policy for how we handle personal information more generally.
08 / Contact
- Email: hello@canvasugcmp.com