Cookie notice
Last updated 16 October 2026.
Terms of use · Privacy notice · Cookie notice · Refund policy
The short version
- Browsing the public pages sets no cookie.
- Once you sign in, two small cookies keep the workspace working: your session and the marketplace you chose. Both are strictly necessary.
- No advertising or analytics cookies and no third-party trackers, so there is no consent banner to click. We count visits ourselves without any cookie (see the privacy notice).
1. Cookies we set
- PHSESS — the sign-in session cookie. Set when you sign in, or when you open a page that needs a session (such as accepting a workspace invitation). Marked Secure, HttpOnly and SameSite=Lax, and it expires when you close the browser. Lax rather than Strict lets you come back signed in from a marketplace's own sign-in screen when you connect an account.
- ph_mkt — the marketplace chosen in the workspace's top bar (for example
uk). Set the first time you open a workspace page and whenever you pick a marketplace. Lasts one year and is sent to our server so pages open on that marketplace. It holds no personal data.
Both are strictly necessary for the service you asked for, so they do not need consent.
Sellers' online shops
A seller's shop built on Product Healer sets no cookies, except phshop followed by the shop's number, only on a
shop its seller has protected with a password, after you type the right one: it remembers that for 30 days (Secure, HttpOnly,
SameSite=Lax) and holds no personal data. A shop keeps your basket in your own browser's local storage
(phcart_ and the shop's number) until you buy or remove it.
Staff only
Our own staff panel uses two further cookies, which customers never receive: PHADMIN, the staff session (limited to the staff panel, SameSite=Strict, ends when the browser closes), and PHADMIN_TRUST, which remembers a trusted device for 30 days so a staff member is not asked for a two-factor code on every sign-in. Only a one-way hash of it is stored on our side.
2. Browser storage
Some display preferences are kept in your browser's local storage. They stay on your device, are not sent to our server, and contain no personal data:
- ph_ccy and ph_bill — on the pricing page, the currency you chose under "Show prices in" and whether you last looked at monthly or yearly prices. Saved only when you use those switches.
- ph_market — inside the workspace, the marketplace you last chose.
- ph_side — inside the workspace, whether the sidebar is collapsed.
- ph_theme — on the website and inside the workspace, whether you chose day, night or auto (sunrise to sunset) colours; auto is used until you choose.
- ph_theme_loc — only if you press "Use my location" in that menu: your position rounded to about 1 km, so "auto" follows your own sunrise and sunset. It stays in this browser and is never sent to us.
- ph_side_y — inside the workspace, how far the sidebar is scrolled, so it stays put when you open another page. Kept in this browser tab only (session storage) and gone when you close it.
- ph_ann_hidden — inside the workspace, which notices you have hidden.
Signed in, the workspace also registers a small service worker so you can add Product Healer to your phone's home screen. It keeps a copy of our own styles, scripts, icons and a "you are offline" page in the browser's cache, so the app opens quickly. It never stores your account pages, figures or anything you type; clear the site's data in your browser to remove it.
If you install our Chrome extension, it keeps its sign-in (or an API token you paste into it) and your display choices (which panels to show, whether a panel is minimised), the costs and fee rates you type into it (per product and per site, so you need not type them again) and the last 50 products you opened (its "Recently viewed" list, which you can clear in the extension) in the extension's own storage in your browser, so it can look up products for you. Remove the extension, or sign it out on Account → Chrome extension, to stop it.
3. Third parties
We load no third-party scripts, fonts, analytics or advertising. Our own small visit-counting script sets no cookie and stores nothing in your browser. The one exception is product images: on workspace pages that show a product, its picture is loaded directly from Amazon's image servers, so Amazon can see your IP address and that the image was requested, as with any image on the web. Links out to marketplaces open in a new tab; those sites have their own policies.
4. Controlling cookies
You can clear or block cookies and local storage in your browser settings. Blocking PHSESS will stop you signing in; clearing the rest only resets your display choices.