Legal
Cookie policy
What fotoyks.fi stores on your device, why, for how long — and how you decide. Based on section 205 of the Finnish Act on Electronic Communications Services (917/2014) and Traficom's cookie guidance.
Updated 21/09/2026 · version 2.0
1. What cookies are
A cookie is a small text file the site stores in your browser and reads on the next page load. The same law covers other browser storage (localStorage and sessionStorage), so we list those too. We use no cookies that follow you to other sites.
2. How you decide
- On your first visit the bar at the bottom asks whether you allow analytics and marketing. "Accept essential only" and "Accept all" are equally easy; "Customize" lets you choose per category. Nothing is pre-selected.
- Non-essential cookies are not set and Google's or Meta's scripts are not loaded before you choose.
- Your choice is kept for 365 days (fotoyks_consent), after which we ask again. We also ask again if our cookie use changes.
- You can change your choice at any time from the "Cookie settings" link at the bottom of the page. Withdrawing consent stops new cookies immediately; third-party cookies already set can be removed in your browser settings.
- Your browser settings can block or delete cookies entirely. The cart and login will then not work.
- We do not react separately to the browser's Do Not Track or Global Privacy Control signals, because we set no tracking cookies without your explicit choice.
3. The list
Everything the site stores on your device. "<tuote>", "<tilaus>" and "<linkki>" stand for the variable part of a name.
3.1 Essential
Without these the cart, login, language choice and photobook editor do not work. They are always set (strictly necessary storage under section 205 of the Finnish Act on Electronic Communications Services) and are not used for tracking.
| Name | Type | Set by | Lifetime | Purpose |
|---|---|---|---|---|
| fotoyks_consent | cookie | fotoyks | 365 days | Stores your cookie choice so we do not ask on every visit. |
| fotoyks_consent | browser storage (localStorage) | fotoyks | until you clear it | The same consent decision, mirrored in browser storage. |
| _medusa_jwt | cookie, hidden from browser scripts | Medusa (fotoyks) | 7 days | Your login session. Account, photo library and editor do not work without it. |
| _medusa_cart_id | cookie, hidden from browser scripts | Medusa (fotoyks) | 7 days | Your cart id so the cart follows you from page to page. |
| _medusa_cache_id | cookie, hidden from browser scripts | Medusa (fotoyks) | 24 hours | Technical cache key so pages load faster. Does not identify you as a person. |
| _medusa_locale | cookie | fotoyks | 365 days | Your language choice (suomi / svenska / English). |
| _fotoyks_order_carts | cookie, hidden from browser scripts | fotoyks | 30 days | Remembers which order-confirmation pages are yours so you can return to them without logging in. |
| _fyks_gp_state | cookie, hidden from browser scripts | fotoyks | 10 minutes | Protects the Google Photos connection against forgery (CSRF). (only when you press "Import from Google Photos") |
| _fyks_gp_token | cookie, hidden from browser scripts | fotoyks | at most 55 minutes | Google's short-lived access token used to fetch only the photos you picked. Not readable by the browser, not stored on the server. (only when you use the Google Photos import) |
| photobook:<tuote> | browser storage (localStorage) | fotoyks | until you clear it | A local copy of your unfinished photobook so work is not lost if the connection drops. (in the photobook editor) |
| photobook:tools | browser storage (localStorage) | fotoyks | until you clear it | Your editor view choice (simple / all tools). |
| photobook:tour-seen | browser storage (localStorage) | fotoyks | until you clear it | Remembers that you have seen the editor tour. |
| photobook:resume-dismissed | browser storage (localStorage) | fotoyks | until you clear it | Remembers that you closed the "You have an unfinished photobook" bar. |
| fotoyks_promo_banner_dismissed_v1 | session storage (sessionStorage) | fotoyks | for the browser session | Remembers that you closed the top promo bar during this visit. |
| fotoyks_campaign_dismissed_<kampanja> | session storage (sessionStorage) | fotoyks | for the browser session | Remembers that you closed the campaign bar during this visit. |
| fotoyks:tracked:<tilaus> | session storage (sessionStorage) | fotoyks | for the browser session | Prevents the same purchase being counted twice if the confirmation page is reloaded. |
| collect:mine:<linkki> | session storage (sessionStorage) | fotoyks | for the browser session | Shows a guest who added photos through an invite link their own photos (thumbnails are made in the browser). (only on the /kuvat invite page) |
| fotomaatti_session | session storage (sessionStorage) | fotoyks | for the browser session | The in-store Fotomaatti kiosk's anonymous session and 6-character resume code. (only on the in-store kiosk) |
3.2 Analytics
Tell us where visitors come from and how the site is used. Set only if you allow analytics. Google Analytics and Tag Manager load only when enabled and consented to.
| Name | Type | Set by | Lifetime | Purpose |
|---|---|---|---|---|
| _fotoyks_utm | cookie | fotoyks | 90 days | Which campaign or link first brought you here (utm parameters), so we know what marketing works. Attached to your order if you buy. |
| _ga | cookie | 2 years | Google Analytics 4: tells visitors apart with a random id. Not in use unless Google Analytics is switched on. | |
| _ga_* | cookie | 2 years | Google Analytics 4: session state. |
3.3 Marketing
Ad measurement and targeting (Meta Pixel: Facebook and Instagram). Set only if you allow marketing and the pixel is enabled.
| Name | Type | Set by | Lifetime | Purpose |
|---|---|---|---|---|
| _fbp | cookie | Meta | 90 days | Meta Pixel (Facebook/Instagram): ad measurement and targeting. Not in use unless the pixel is switched on. |
| _fbc | cookie | Meta | 90 days | Meta Pixel: the ad click id. |
4. Third parties
| Service | What it receives | More |
|---|---|---|
| Google Analytics 4 / Tag Manager (Google Ireland Ltd) | Page loads, events (add to cart, purchase with amount), device data, truncated IP. Only with analytics consent. | policies.google.com/privacy · GA4 does not store IP addresses |
| Meta Pixel (Meta Platforms Ireland Ltd) | Page loads and purchase events plus Meta's own browser identifier. Only with marketing consent. | facebook.com/privacy/policy |
| Google Photos (Google LLC) | No cookies from us. When you connect, Google asks permission to give us the photos you picked; the permission expires within an hour. | Only if you press "Import from Google Photos" |
| Paytrail Oyj | The payment page is Paytrail's; its cookies are described in Paytrail's own policy. | paytrail.com/tietosuojaseloste |
Our own visitor statistics use no cookies and store nothing on your device — described in section 2 of the privacy notice.