This policy explains the cookies and browser storage that Find Film (findfilm.app), operated by Gotham West Studios LLC, uses. Our Privacy Policy explains how we handle personal information more generally.
1. What these are
#A cookie is a small file that a website asks your browser to keep and send back with later requests. Browser storage (local storage and session storage) lets a page keep information in your browser; it is not sent to our servers automatically. Local storage stays until it is deleted. Session storage normally lasts until the browsing session ends, usually when you close the tab (a browser that restores tabs can restore it too).
2. Essential cookies, and analytics only if you allow it
#"Essential" means needed to provide something you asked for: loading the site, signing in, keeping your account secure, or remembering a setting you chose. The law allows these without asking for consent, but we tell you about each one below (sections 3 and 4).
Everything else is optional: analytics, which stays off until you turn it on (section 5). We don't use advertising, social media or other tracking cookies. Maps load from Amazon Location Service, and your browser sends no cookies with those requests. The essential cookies below are set by findfilm.app itself, and your browser sends them only to findfilm.app, only over secure connections.
The security check on our Suggest a store, Report an issue and Contact forms (Cloudflare Turnstile) is strictly necessary too, so it is not one of the choices. It loads from challenges.cloudflare.com only when you start using one of these forms, and Cloudflare may keep its own security cookies there for the check. We don't use it for advertising. What your browser sends to Cloudflare is in section 7.
3. Cookies
#| Name | What it does | How long |
|---|---|---|
ff_consent | Remembers your choices in the cookie banner or Cookie settings: the version of this policy you answered, whether you turned analytics on or off, and when. Set only once you make a choice. It holds no name, email address or account ID, and page scripts can read it. | 12 months, once set |
| Name | What it does | How long |
|---|---|---|
__Host-ff_member_id | Keeps you signed in. Holds your sign-in token, which contains your email address and account ID. Page scripts can't read it. | 60 minutes, renewed while you stay signed in |
__Host-ff_member_refresh | Renews your sign-in without a new code. Page scripts can't read it. | 30 days, or until you sign out |
__Host-ff_member | A simple flag that tells the page you may be signed in, so it doesn't check with our server when you aren't. Its value is always "1". | 30 days, or until you sign out |
__Host-ff_member_terms | Shows that your account has accepted the current Terms of Service, so you can save or remove stores, confirm or report facts, and manage a listing. Set only after we have recorded your acceptance. It holds the version and a code tied to your account, not your email address. Page scripts can't read it. | 30 days, or until you sign out |
__Secure-ff_member_sign_in | Holds your sign-in, in encrypted form, while you enter the code we emailed. Sent only to the sign-in service. | Up to 5 minutes |
__Secure-ff_member_device | Marks this browser as one that has signed in before, so it can still sign in if many codes are requested for your address. Contains no email address. Stays after you sign out. Sent only to the sign-in service. | 180 days |
| Name | What it does | How long |
|---|---|---|
__Host-ff_id, __Host-ff_refresh | Keep an administrator signed in | 60 minutes; 30 days |
__Secure-ff_sign_in | Holds an administrator's sign-in while they enter the code | Up to 5 minutes |
__Secure-ff_admin_device | Marks a browser an administrator has signed in with before | 180 days |
__Host-ff_oauth | Links an administrator's approval of an AI assistant connection to their browser, for security | 15 minutes |
4. Browser storage
#None of these is sent to our servers automatically. The one exception is the page that opens a link from our email: it sends the link's code, from ff_outreach, to our server to check the link.
| Name | What it does | How long |
|---|---|---|
ff-theme | Your light or dark theme choice | Until you change it or clear your browser data |
ff.saved.v1 | The list of stores you saved, so Save buttons respond instantly. Labeled with a short code made from your email address. | Until you sign out |
ff.saved-cards.v1 | A copy of your Saved page (public store information), so it works offline | Until you sign out |
ff.confirmed.v1 | When you last confirmed each store, so a store page can say "You confirmed this N days ago" | Each entry for 30 days; everything is deleted when you sign out |
ff-dev-filter | The processes and film sizes you picked in a store page's Developing filter (or in your results filters), so the other store pages you open, in any tab, start with them | Used for 3 hours after you last used it; deleted the next time you open a store page or search results after that |
| Name | What it does | How long |
|---|---|---|
ff-last-results | Your last results view (filters, sort, selected store; no location), for the "Back to results" and Map links | Until the browsing session ends (normally when you close the tab) |
ff-search-origin | The place you searched from, passed to the results page. If you used "Use my location", this is your device's location. It never leaves your browser. | 30 minutes, then deleted (or when the browsing session ends, if sooner) |
ff-map-style:light, ff-map-style:dark | The address of the map style, which includes our public map key, so maps load faster | 10 minutes |
ff_outreach, ff_outreach_draft, ff_outreach_done | For a business using a link from our email: the link's code, unsaved edits, and the final result, so a reload doesn't lose them. The page sends the link's code to our server to check the link and save your answer | Removed when you finish, or when the browsing session ends |
5. Analytics (only if you allow it)
#With your permission, we may use PostHog and Google Analytics on public pages to understand how Find Film is used and improve it. If you turn on "Analytics" in the cookie banner or in Cookie settings, our public pages load analytics code and the storage and cookies below are set. Until you do, and if you reject analytics or your browser sends the Global Privacy Control signal, none of this code loads, nothing is sent to these services, and none of these is set. Analytics runs only on public pages: never on the contact, store portal or admin pages, or while the sign-in window is open. You can withdraw permission at any time in Cookie settings.
- PostHog (PostHog, Inc., United States) counts page views and a few actions: choosing a place to search, changing the filters or the sort, viewing a store, opening directions, saving a store, confirming or reporting (only which kind), and sending a suggestion. It never receives what you type, and it doesn't record sessions. It also reports errors in our pages. It keeps its data in your browser's storage (keys starting with ph_), not in cookies.
- Google Analytics (Google LLC), if we use it, counts visits, page views and clicks on links to other sites (with the link's address) with the cookies below, and estimates your approximate location (country, region and city) and your device's details (such as its model, and your browser and operating system versions). We have turned off Google signals and Google's advertising features, and we never send it your name, email address or account.
The random IDs these services keep are pseudonymous identifiers: they hold no name or email address, but they tell your visits apart, so we treat them as personal information. We don't tell these services who you are. The Privacy Policy explains what they receive, why, and for how long it is kept.
| Name | What it does | How long |
|---|---|---|
ph_* | PostHog's analytics storage (keys starting with ph_): a random ID for this browser (a pseudonymous identifier: it holds no name or email address, but it is how PostHog tells your visits apart), the current visit's ID and timing, the addresses of the visit's first page and of the page you came from (cut as described in the Privacy Policy), and PostHog's settings for this site | Until you turn analytics off (we then delete it) or clear your browser data |
| Name | What it does | How long |
|---|---|---|
ph_* | Tell PostHog which visit and which browser tab events belong to (keys starting with ph_). If you came from a search engine, also its name and any search words it passed on, which are never sent to PostHog | Until you turn analytics off (we then delete it), or until the browsing session ends |
| Name | What it does | How long |
|---|---|---|
_ga | Google Analytics' random ID for this browser, so it can count visitors and tell new visits from returning ones. Contains no name or email address | 13 months after your last visit |
_ga_<container-id> | Keeps Google Analytics' visit count and the current visit's state for this site (its name ends with the site's Google Analytics ID) | 13 months after your last visit |
6. Your choices
#- Analytics. Turn it on or off at any time in "Cookie settings", at the bottom of every page. Turning it off stops it at once, in every tab of findfilm.app that is open, and deletes the storage and cookies in section 5 that findfilm.app can reach in your browser. It stops future collection; what was already sent is kept as our Privacy Policy describes. We can find that only with the random ID in that storage, and turning analytics off deletes the ID: while analytics is on, Cookie settings shows the ID with a Copy button, so you can copy it first and send it with a deletion request (the Privacy Policy, section 10). Turning analytics off never depends on this.
- Global Privacy Control. If your browser sends this signal, we treat it as your choice to keep analytics off, and we don't ask.
- Your browser settings let you block or delete cookies and site data. If you block essential cookies, signing in won't work.
- Signing out deletes the member cookies (except the device marker) and the member data in local storage.
- Session storage, including any location from "Use my location", is deleted when the browsing session ends. That location is deleted after 30 minutes in any case.
- You can turn location access for findfilm.app on or off in your browser settings.
- "Cookie settings" lists the cookies and storage in use, by category. Saving a choice there, or in the cookie banner, sets
ff_consent.
7. Information your browser sends to other companies
#Japan's Telecommunications Business Act asks websites to say what information a visitor's browser sends to other companies, to whom and why. On Find Film:
| Company | What is sent | Why | When |
|---|---|---|---|
| Amazon Web Services, Inc. (Amazon Location Service) | IP address, browser type, findfilm.app as the referring site, and which map tiles are shown | To show maps | On pages with a map |
| PostHog, Inc. | A random ID for your browser and visit, the pages you view (their addresses, without anything you typed) and the site you came from (not the page on it), the actions in section 5, error details, your browser, device, screen size and language, and your IP address, which PostHog uses to estimate your approximate location (country, region and city) and then discards rather than storing | To understand how Find Film is used, improve it and fix errors | Only after you turn analytics on, on public pages |
| Google LLC (Google Analytics) | A random ID for your browser, the pages you view and the site you came from (not the page on it), the links to other sites you follow and their addresses, your browser and its version, your device (including its model), operating system and its version, screen size and language, and your IP address, which Google uses to estimate your approximate location (country, region and city) and doesn't store | To count visits, page views and clicks on links to other sites | Only if we use Google Analytics and you turn analytics on, on public pages |
| Cloudflare, Inc. (Cloudflare Turnstile, challenges.cloudflare.com) | Your IP address, browser and device details (user agent, TLS fingerprint) and the site the check runs on (findfilm.app) | A security check that keeps automated spam and abuse off our public forms (strictly necessary) | Only when you start using the Suggest a store, Report an issue or Contact form, and about every five minutes while that page stays open |
To stop the analytics ones, turn analytics off in "Cookie settings" (section 6).
8. Contact
#Gotham West Studios LLC, 447 Broadway, 2Fl #800, New York, NY 10013, United States
Phone: (212) 500-1890 (+1 212 500 1890)
findfilm.app/contact