Cookie Policy
The short version
- Cookies are small files a website stores in your browser. Pixels and tags do a similar job. We use both.
- Some cookies are necessary. Without them the cart, the checkout and the link to the report you paid for may stop working properly.
- The rest are used for analytics (how many people visit, where they came from), advertising (Meta and TikTok, so we can measure our ads) and email marketing (Klaviyo).
- There is no cookie banner on this site. The advertising and analytics tags load as soon as a page opens. In the United States and Canada the rule is opt-out, not permission first. This page is a notice, not a gate. Section 6 explains how to opt out.
- We do not read or act on "Do Not Track" or Global Privacy Control signals. That is the plain truth as of the date at the bottom of this page. Section 8 explains what to do instead.
- Most of the cookies below sit under our own domain, even when another company's script sets them. So "block third-party cookies" will not remove them. Section 6 says what does.
- Some measurement is sent from our server, not from your browser. Section 7 says what that means and what we can and cannot switch off for you.
- We never see or store your card number. Stripe handles the payment.
The full list of the cookies we found when we last measured the site is in Section 4.
1. Who this policy belongs to
This site, myheritagestories.com, is operated by FamilyCrests Studio LLC, trading as FamilyCrests™. We are based in Wyoming, USA.
This policy covers cookies and similar technologies only. How we handle personal information in general — including how to ask for a copy of your data or ask us to delete it — is in our Privacy Policy. Both are handled at the same address: customer@myheritagestories.com.
2. What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store. The next time you load a page, your browser sends that file back. It is how a site remembers that the item in your cart is yours, or that this browser already opened the report you paid for.
This matters more here than on most sites, because you do not create an account to buy from us. Checkout is as a guest. Often the cookie is the only thing connecting this browser to the order you just placed.
We also use technologies that do a similar job without being cookies:
- Pixels and tags. A pixel is a small piece of code — usually an invisible image or script — that loads when you open a page. It tells the company that provided it (Meta, TikTok, Google, Klaviyo) that a page was viewed, or that a purchase happened. Pixels work together with the cookies listed below.
- Browser storage. Some scripts keep small values directly in your browser rather than in a cookie. From your side it behaves the same way, and clearing your browsing data clears it too. Our measurement covered cookies, so that storage is not itemised in the tables below.
- Pixels in our emails. Our marketing emails carry a small Klaviyo image that tells us the email was opened, and links that tell us it was clicked. Turning off image loading in your email app stops the open tracking. The unsubscribe link at the bottom of every marketing email stops the emails altogether — one click, no reply needed.
- Measurement sent from our server. Some events, such as a completed purchase, are also sent from our own server straight to the ad platforms, without passing through your browser. Cookie settings do not reach that path. Section 7 explains it honestly, including what we cannot switch off today.
3. First-party and third-party cookies
- First-party cookies are stored under our own domain. Third-party cookies are stored under another company's domain.
- Read that distinction carefully here. Several advertising and analytics cookies on this site —
_fbp,_ttp,_ga,__kla_id— are set by another company's script but stored under our domain. They are first-party cookies feeding a third party. Blocking "third-party cookies" in your browser does not remove them. - We can switch a third-party tool off on our side, but we do not control what that company does with data it already holds. Their own privacy policies apply to that.
- Session cookies disappear when you close your browser. Persistent cookies stay for a fixed period, shown below, unless you delete them sooner.
4. The cookies this site uses
Durations are the maximum lifetime. A cookie can be refreshed while you keep using the site. Third parties rename or re-time their cookies without telling us in advance, so this list can drift between reviews.
Two things this table does not cover: cookies set on Stripe's own pages when a payment is completed there, and cookies set by the shipment tracking page for physical orders. Those sit under those companies' domains, and their policies apply.
4.1 Necessary and functional — the site does not work properly without these
| Name | What it does | Who sets it / receives the data | How long it lasts |
|---|---|---|---|
__cf_bm | Bot filtering. Tells automated traffic apart from real visitors. | Cloudflare, used by our host Rocket.net | 30 minutes |
__stripe_mid | Fraud prevention on payments. Recognises the browser across visits. | Stripe | 12 months |
__stripe_sid | Fraud prevention within a single payment session. | Stripe | 30 minutes |
fc_legacy_key | Remembers that this browser is entitled to the report you bought, so you do not have to open the emailed link every time. | FamilyCrests (first party) | 12 months |
fc_crossing_key | Remembers that this browser is entitled to The Crossing report you bought, so you do not have to open the emailed link every time. | FamilyCrests (first party) | 12 months |
g_state | Remembers the state of the Google Sign-In prompt so it is not shown over and over. Only relevant if you use Google Sign-In for the report portal, which is optional. | 6 months | |
wffn_flt | Keeps checkout state so the right page and offer are shown. | FunnelKit, our checkout software (first party) | 2 days |
wffn_timezone | Records your time zone, used by the checkout. | FunnelKit (first party) | 2 days |
wffn_is_mobile | Records whether you are on a phone, so the checkout layout matches. | FunnelKit (first party) | 2 days |
wffn_browser | Records your browser type so the checkout renders correctly. | FunnelKit (first party) | 2 days |
wffn_referrer | Records which page sent you into the checkout. | FunnelKit (first party) | 2 days |
wffn_fl_url | Records the checkout page address for the order flow. | FunnelKit (first party) | 2 days |
4.2 Analytics — how the site is used
| Name | What it does | Who sets it / receives the data | How long it lasts |
|---|---|---|---|
_ga | Tells one visitor apart from another for visit statistics. | Google Analytics (stored under our domain) | 2 years |
_ga_99C8B37NZN | Keeps session state for our particular Analytics property. | Google Analytics (stored under our domain) | 2 years |
sbjs_first | Records the first source that ever brought you to the site. | Sourcebuster (first party) | Session |
sbjs_current | Records the source of your current visit. | Sourcebuster (first party) | Session |
sbjs_first_add | Extra details about that first visit, such as landing page and date. | Sourcebuster (first party) | Session |
sbjs_current_add | Extra details about the current visit, such as landing page and date. | Sourcebuster (first party) | Session |
sbjs_udata | Basic browser data used to attribute the visit. | Sourcebuster (first party) | Session |
sbjs_session | Counts page views inside the current visit. | Sourcebuster (first party) | Session |
sbjs_migrations | Internal housekeeping for the cookies above. | Sourcebuster (first party) | Session |
We use this to answer questions like "how many people read the report page" and "which ad brought this visit." We do not use Analytics to identify you by name.
4.3 Advertising — measuring and targeting our ads
| Name | What it does | Who sets it / receives the data | How long it lasts |
|---|---|---|---|
_fbp | Identifies the browser to Meta, so ad clicks can be matched to purchases and so we can show you ads later. | Meta's script (stored under our domain) | 3 months |
_ttp | Identifies the browser to TikTok, for the same purpose. | TikTok's script (stored under our domain) | 13 months |
_tt_enable_cookie | Records that TikTok measurement is switched on for this browser. | TikTok | 13 months |
ttcsid | Measurement identifier for TikTok, refreshed as you browse. | TikTok | 13 months |
ttcsid_D7A41T3C77U7B0LEL3O0 | The same, tied to our particular TikTok pixel. | TikTok | 13 months |
We do not sell your personal information for money. But these cookies do send behaviour data to Meta and TikTok, and several U.S. state privacy laws define "sale," "sharing" or "targeted advertising" broadly enough to cover that. We would rather you knew it than have us hide behind the narrow meaning of the word. Sections 6 and 7 tell you how to limit it, and where the limits of our reach are.
4.4 Marketing — email
| Name | What it does | Who sets it / receives the data | How long it lasts |
|---|---|---|---|
__kla_id | Connects site activity to your email profile, if you subscribed, so our emails are relevant. | Klaviyo's script (stored under our domain) | 11 months |
5. What happens if you block the necessary cookies
You can block them. Some things are likely to break:
- The checkout may fail, loop, or lose your order details.
- Stripe's fraud checks lose signals, so a legitimate payment is more likely to be flagged or declined.
- You will need the link we emailed you every time you want to open your report, because
fc_legacy_keyis what lets this browser remember it. The link itself keeps working. - Google Sign-In to the report portal may keep prompting or refuse to complete.
Two things blocking cookies does not break: the PDF of your report, which arrives by email, and the despatch of a physical order, which depends on the address you gave at checkout. Delivery is covered in our Shipping & Delivery page.
If you have already paid and you lose access after clearing cookies, write to customer@myheritagestories.com and we will send the link again.
The analytics, advertising and email cookies in Sections 4.2 to 4.4 are not needed to buy anything. Blocking them changes nothing about what you receive.
6. How to opt out of advertising and analytics
There are several routes and they do different jobs. You can use more than one. Please read Section 7 as well, so you know what none of these routes reach.
In your browser. Every major browser lets you delete cookies and block new ones. Look under Settings, then Privacy. Two warnings, both real:
- Deleting cookies removes the advertising ones, but they are set again on your next visit unless you also block them.
- Blocking only third-party cookies will not stop
_fbp,_ttp,_gaor__kla_id, because those sit under our own domain. To stop those you need to block cookies for this site, block the scripts, or use a content blocker.
At the ad platforms. This route is more durable, because it follows your account across devices instead of one browser. These companies redesign their menus often, so if the path below has moved, search their help centre for "ad preferences."
- Meta (Facebook and Instagram): in Accounts Center, under ad preferences, and under the section covering your activity off Meta's apps, where you can disconnect activity that sites like ours have sent.
- TikTok: Settings and privacy, then Ads, then Ads personalization.
- Google: myadcenter.google.com controls ad personalization. Google also publishes a Google Analytics opt-out browser add-on that stops Analytics measuring you on the sites you visit.
With industry tools. These set opt-out signals for many advertising companies at once:
- Digital Advertising Alliance — optout.aboutads.info, and the YourAdChoices app for mobile
- Digital Advertising Alliance of Canada — youradchoices.ca
- Network Advertising Initiative — optout.networkadvertising.org
These tools are themselves cookie-based. If you clear your cookies, you may need to set them again.
On your device. On iPhone: Settings, then Privacy & Security, then Tracking, where you can refuse app tracking. On Android: the ads section of your privacy settings, where you can delete or reset the advertising ID. The exact wording varies by phone.
By email — the only route that reaches us. Write to customer@myheritagestories.com from the address you used with us and ask us to stop sharing your information for targeted advertising. A person handles it by hand; there is no automatic switch. We reply within 48 hours.
Here is exactly what that request does and does not do.
- What we do: take you out of our email marketing, and take you out of the advertising audiences we control on Meta and TikTok, so we stop building ads around you.
- What we cannot do: delete data that Meta, TikTok or Google already hold, stop their cookies loading in your browser, or switch off the server-side measurement described in Section 7. For those, use the platform and browser routes above.
The same email address also handles requests to see or delete the personal information we hold. Those are explained in the Privacy Policy, and our Your Privacy Choices page says the same thing this section says.
7. What our opt-out cannot reach
Some events, such as a completed purchase, are sent from our own server directly to Meta and TikTok. That path does not use your browser, so clearing or blocking cookies does not affect it.
Today we have no way to switch that server-side path off for one person. We are telling you that instead of offering you a button that does nothing. If that changes, we will say so here and change the date at the bottom of this page.
What you can do about it: change your settings at Meta, TikTok and Google as described in Section 6. That does not stop an event being sent, but it limits how those companies may use it on their side — including whether they use it to pick ads for you. And you can always ask us to remove you from our email marketing and from the audiences we control, which we do.
8. Do Not Track and Global Privacy Control
Some browsers can send a "Do Not Track" header, or a Global Privacy Control signal, that asks a site not to share your data for advertising.
Our site does not read or act on either signal. There is no code on this site that detects them, so sending one changes nothing here. We would rather say that plainly than claim a protection you do not have.
The route that does work is the email request in Section 6: write to customer@myheritagestories.com and we will act on it by hand. If you ever find a page on this site that says we honour these signals automatically, that page is out of date and this one is the accurate one. If we add automatic handling later, we will say so here and change the date at the bottom.
9. What we do not use cookies for
Based on the same measurement: we do not use cookies to collect health data, biometric data or precise location. We do not use them to collect financial details — your card number goes straight to Stripe and never touches our site. We do not run session-recording or heatmap software, so nothing here films your screen or your mouse.
Two separate rules about age, which are easy to confuse:
- You must be 18 to buy from us. That is a condition of sale and it is in our Terms of Service.
- Separately, we do not sell or share the personal information of anyone under 16, as California law defines those terms. That is explained in the Privacy Policy.
10. Changes to this policy
We review this list when we add, remove or replace a tool on the site. Third parties can rename or re-time their own cookies without telling us, so the tables can drift between reviews. The date at the bottom shows the last time we checked. There is no notification list for cookie changes — if it has been a while, look at the date.
11. Contact
Questions about this policy, or a request to stop advertising sharing:
customer@myheritagestories.com
Email is our only support channel. We have no phone line and no live chat. We answer within 48 hours. If you would rather start from our contact page, it is here.
For a copy of the personal information we hold, or to ask us to delete it, see the Privacy Policy — the same address handles those requests, including for customers in Europe who bought from us in the past.
Last updated: August 24, 2026
FamilyCrests Studio LLC, based in Wyoming, USA — FamilyCrests™.