--- title: Actorly cookie policy for actorly.app description: What cookies the Actorly website sets, what each is for, how long it lasts and how to control it. Nothing optional runs until you say yes. canonical: https://admin.actorly.app/cookies --- Legal # Cookie policy. What cookies the Actorly website sets, what each is for, how long it lasts and how to control it. The short version: nothing optional runs until you say yes. ONDUTYOPS LLC[team@actorly.app](mailto:team@actorly.app) Effective 2026-10-13 Effective 2026-10-13. Updated 2026-10-15 to say that the Meta Pixel and Meta's Conversions API are also told about article reads, help center searches and chat opens. Updated 2026-10-14 to add Google Analytics, the Meta Pixel and the choice you make in the cookie banner. This policy covers the website at actorly.app. It works alongside the privacy policy. Updated 2026-10-15 to add Google Consent Mode, the Global Privacy Control note and the privacy center. Updated 2026-10-17 to say that a Global Privacy Control signal now keeps Google Analytics and Cloudflare Web Analytics off as well as Marketing, and that we keep the record of a cookie choice for 24 months. Updated 2026-10-17 to add the anonymous count of how often the cookie banner is shown. Updated 2026-10-19 to add the cookie that keeps your chats and tickets together when you write to us in the chat, and the counters that limit abuse of the chat. ### Contents 15 sections ## 1 What this policy covers 1.1 This policy is about the Actorly website at actorly.app, run by ONDUTYOPS LLC. It is not about the Actorly app, which runs inside the Shopify admin. Section 9 says what applies there. 1.2 A cookie is a small text file that a website asks your browser to keep. Similar technologies, such as local storage and tracking pixels, are covered here too. Back to contents ## 2 The short version 2.1 When you first visit, the website asks what you allow. Until you answer, it sets no cookie and sends nothing to Google or Meta, except that if you send a message in the chat we set the one cookie that keeps your conversation together (listed below). 2.2 There are two kinds of optional tool. Google Analytics 4 and Cloudflare Web Analytics count page views, and run only if you turn Analytics on in Manage choices. The Meta Pixel and Meta's Conversions API tell Meta about page views, article reads, help center searches, chat opens and clicks, and run only if you turn Marketing on. Accept all turns both on, unless your browser sends Global Privacy Control, which keeps both off as Your choices says, and Reject all leaves both off. 2.3 Apart from the Meta Pixel, which is off until you allow Marketing, the website uses no advertising cookies, no tracking pixels, no session replay and no social media plugins. Its own code uses only the cookies listed here, and does not use local storage or session storage. Back to contents ## 3 Your choices 3.1 Nothing except the strictly necessary cookies below runs until you choose. That is true in every country, including those where the law does not require it. We would rather ask than guess where you are. 3.2 The banner offers Accept all, Reject all and Manage choices. Accept all and Reject all are the same size, and each takes one click. 3.3 You can change your mind at any time with the Your Privacy Choices button in the footer of every page. Withdrawing consent is as easy as giving it. When you turn analytics off, the website tells Google, and deletes the Google Analytics cookies it can reach. When you turn marketing off, the website tells the Meta Pixel to stop, sends nothing more to Meta, and deletes the _fbp and _fbc cookies it can reach. 3.4 If your browser sends a Global Privacy Control signal, we treat it as a refusal of everything optional and honour it whatever else is set. Google Analytics, Cloudflare Web Analytics and Marketing stay off, pressing Accept all does not turn them on, and Google Consent Mode stays denied. The banner and the choices dialog say so. The signal can only turn things off, with one exception that is yours: you can still turn on Analytics alone, in Manage choices or in the privacy center, and we record that you did. Marketing cannot be turned on while the signal is sent. 3.5 If your browser sends a Global Privacy Control signal, the choices dialog and the privacy center say so, and the record of your choice notes that the signal was present. The signal is read before any optional tool can run. 3.6 The privacy center (the Privacy center link in the footer) has the same switches as the dialog, one switch that turns Marketing off and records it as an opt-out of sale and sharing, and a form for requests about your personal information. 3.7 We ask again if what we use changes, and when the wording of the banner changes. Back to contents ## 4 Strictly necessary 4.1 These do not need your consent. Without them the website cannot remember what you decided, let our editors sign in, or show you your own chat and tickets. CookiePurposeLastsCategory actorly_consentStores the choice you made in the banner, so you are not asked again on every page. It holds what you allowed in each category, a random id, the banner version and the date. It holds no name, no email address and no IP address. It is set when you answer, never before. It is marked Secure and SameSite=Lax; it is not marked HttpOnly, because the banner's own script has to read it.13 monthsStrictly necessary act_admin_sessionKeeps an editor signed in to the editing area. It holds a random sign-in token, and the website stores only a hash of that token. It holds no name, no email address and no tracking identifier. Only our own editors, who write the blog and the changelog, ever receive it. It is marked HttpOnly, Secure and SameSite=Lax.8 hours, or until the editor signs outStrictly necessary __Host-act_vsKeeps your chats and tickets with us together, so that when you come back in this browser you see your own and nobody else's. It is set only after you send your first message in the chat. Opening a page or the chat does not set it. It holds a random visitor number, the number of your current chat, the time it was issued and a signature that stops it being forged. It holds no name, no email address and no IP address, and we do not use it for analytics, advertising or tracking. It is marked HttpOnly, Secure and SameSite=Lax, and is sent only to actorly.app.30 days from your last message or the last time you opened the chatStrictly necessary Back to contents ## 5 Analytics 5.1 Off until you allow it. This tells us which pages get read, so we know which are worth keeping. We do not sell this data and we do not use it for advertising. CookieSet byLasts _gaGoogle Analytics 4, from Google Ireland Limited. Tells one browser apart from another.2 years _ga_Google Analytics 4, from Google Ireland Limited. Keeps the current visit together.2 years 5.2 Cloudflare Web Analytics, from Cloudflare, Inc., also counts page views and page speed, without setting a cookie. It is loaded only after you allow analytics, through the same choice as Google Analytics, and not before. If you turn analytics off, it is not loaded on the next page. 5.3 Google's script is requested from Google only after you allow analytics. We turn off Google's advertising features for it. Google's own privacy policy applies to what Google does with the data it receives. Back to contents ## 6 Google Consent Mode 6.1 The website uses Google Consent Mode version 2 to tell Google what you allowed. Before you choose, all four signals are set to denied, in every country, the European Economic Area and the United Kingdom included: analytics_storage, ad_storage, ad_user_data and ad_personalization. The website also asks Google's tag to wait up to half a second for a stored choice before it reads them. 6.2 Turning Analytics on sets analytics_storage to granted. A Marketing choice, where the website offers one, sets ad_storage, ad_user_data and ad_personalization together, and only when you allow Marketing. The website runs no Google Ads tag today, so those three signals change nothing now. They are set so that any advertising tag added later starts from what you chose. 6.3 Google's script is not requested at all until you allow analytics, so before you choose no request goes to Google, not even the cookieless pings that some websites send. Back to contents ## 7 Marketing 7.1 Off until you allow it. This tells Meta, the company behind Facebook and Instagram, when you view a page of this website, read an article, search the help center, open the chat, click Install free on Shopify, or click a link to email us, so that we can measure our advertising on Meta. The Meta company that receives it is Meta Platforms Ireland Limited for visitors in the European Union and the European Economic Area, and Meta Platforms, Inc. for visitors elsewhere. The one thing you type that is sent is the words you search for in the help center, so please do not type personal details there. We do not send Meta anything you type into a form or into the chat, and we do not send it your name, your email address or anything from the Actorly app. CookieSet byLasts _fbpMeta Pixel and Conversions API, from Meta Platforms Ireland Limited. Identifies the browser to Meta.3 months _fbcMeta Pixel and Conversions API, from Meta Platforms Ireland Limited. Holds the Meta ad click id, if the visitor arrived from a Meta ad.3 months 7.2 Meta's script is requested from Meta only after you allow marketing. The Pixel runs in your browser and sends Meta the full address of the page you are on, including any query string, and the page you came from, together with details of your browser. The website's server also sends the same event to Meta's Conversions API, with the page address without its query string, your IP address, your browser's user agent and the two cookies above if your browser has them. The two copies carry one event id, so Meta counts the event once. Meta's own privacy policy applies to what Meta does with the data it receives, including data it receives about you when you are signed in to a Meta product. Back to contents ## 8 The record of your choice 8.1 When you choose, the website stores a record of that choice on our server, so that we can show what we asked and what you answered. The record holds the random id from your consent cookie, what you allowed, which banner wording and cookie policy version you saw, the time, the page you were on, your country and region as our host reports them, whether your browser sent a Global Privacy Control signal, and a hash of your browser's user agent. That hash is not anonymous: a user agent is one of a limited number of values, so someone could match it, and we treat it as personal data. It is kept as long as the record, 24 months. It does not hold your IP address. 8.2 We keep the record of a choice for 24 months from the date you made it, the same period as a privacy request. If your browser sends Global Privacy Control and you choose Analytics alone, the record names that as the way the choice was made. 8.3 If you choose again, we add a new record. We do not change the old one. The same applies when you use the Do Not Sell or Share My Personal Information switch in the privacy center: it adds a record, and the record names that switch as the way the choice was made. The privacy policy gives our legal basis for keeping it. 8.4 To know how many visitors see the cookie banner, the website counts each time it is shown, by day, country, device type, banner version and whether a Global Privacy Control signal was sent. The count itself sets no cookie and holds no identifier. The count holds no personal data and is kept as an aggregate with no end date. 8.5 To limit abuse, the website also keeps a counter tied to a hash of your IP address, which is deleted automatically 10 minutes after the banner was last shown to you; it is not stored with the count above and is not used for any other purpose. A hash of an IP address is not anonymous: someone who tried every possible address could match it, so we treat it as personal data. 8.6 To limit abuse in the chat, the website keeps counters, each tied to a hash of your IP address, so that one connection cannot send a flood of messages or open a flood of chats. A counter is deleted automatically within about a minute, and the counter of new chats within about an hour. For an IPv6 address, the hash covers its network part, not the whole address. A hash of an IP address is not anonymous: someone who tried every possible address could match it, so we treat it as personal data. It is not used for any other purpose. Back to contents ## 9 Why we need no consent for the strictly necessary cookies 9.1 The consent cookie only remembers your answer. The sign-in cookie is for a service an editor has asked for, which is to stay signed in. Privacy laws such as the ePrivacy rules in Europe and the UK do not require consent for a cookie of that kind, so we do not ask for it. The chat cookie is for a service you asked for, which is to write to us and see our reply and your own earlier chats. We still list all three here so that you can see them. Back to contents ## 10 What our host does 10.1 The website is served by Cloudflare. To deliver pages and to protect the site from abuse, Cloudflare handles each request, including the visitor's IP address, and may keep technical logs under its own terms. That is a service log and not a cookie, and we do not use it to profile visitors. The subprocessors page lists Cloudflare. Back to contents ## 11 The Actorly app inside Shopify 11.1 The Actorly app runs embedded in the Shopify admin, under Shopify's session model. Shopify provides and manages the session and any cookie it needs there, under Shopify's own policies. Actorly adds no cookie, script, theme code or pixel to your store's storefront, so shoppers load nothing from Actorly. 11.2 How the app handles personal data is described in the privacy policy, in the section on cookies and website analytics, and in the section on what we collect. Back to contents ## 12 How to control cookies 12.1 The Your Privacy Choices button in the footer is the quickest way. You can also see, block and delete cookies in your browser settings. The help pages of Chrome, Firefox, Safari and Edge say how. 12.2 Blocking or deleting actorly_consent means the banner asks you again on your next visit, and until you answer nothing optional runs. Blocking or deleting act_admin_session has one effect: an editor is signed out and must sign in again. Nothing changes for a visitor. Blocking or deleting __Host-act_vs means we cannot show you your earlier chats and tickets in this browser; a message you send afterwards starts as a new visitor. 12.3 The website does not read a Do Not Track signal, because nothing optional runs without your yes. It does read Global Privacy Control, as described above. Back to contents ## 13 Third-party cookies 13.1 The only third-party scripts the website loads are Google's and Cloudflare's, only after you allow analytics, and Meta's, only after you allow marketing. Separately, the live chat from Crisp IM SAS (hosted in the EU) loads only when you click Chat with us, and then stores a session in your browser so the conversation continues. Until you click, nothing from Crisp is requested. The website loads no third-party fonts or images that set cookies: its fonts and its own scripts are served from actorly.app itself. The links to Shopify, to the Shopify App Store and to Cloudflare's pages lead to other websites, which have their own cookie policies. We do not control them. Back to contents ## 14 Changes to this policy 14.1 We will post changes on this page with a new date. If the website ever starts to use a cookie or a similar technology other than the ones above, we will update this page, and ask for consent where the law requires it, before the change goes live. This policy took effect on 2026-10-13 and was updated on 2026-10-19. Back to contents ## 15 Contact 15.1 ONDUTYOPS LLC. Email: team@actorly.app. Postal address: Coastal Highway, Lewes, Delaware 19958, United States. 15.2 More on how we handle personal data is in the privacy policy, and rights requests are explained on the data protection page. Back to contents [Privacy policy →](https://admin.actorly.app/privacy)[Terms of service →](https://admin.actorly.app/terms)[Data processing agreement →](https://admin.actorly.app/dpa)[Data protection and your rights →](https://admin.actorly.app/gdpr)[Subprocessors →](https://admin.actorly.app/subprocessors)