Last updated: 18 May 2026
This Cookie Policy explains how PHmuseum Srl ("PhMuseum," "we," "us," and "our") uses cookies and similar technologies when you visit https://phmuseum.com (the Website). It should be read together with our Privacy Policy.
We use a consent banner so you can Allow all, Deny non-essential cookies, or Customise optional categories (Preferences, Statistics, Marketing). Essential cookies remain active because the Website cannot operate reliably without them.
Cookies are small text files stored on your device. First-party cookies are set by PhMuseum. Third-party cookies are set by partners (for example Google or Meta) when you allow the relevant category.
Information collected via cookies may become personal data when combined with other information we hold. Our Privacy Policy explains how we process personal data more broadly.
| Action | What happens |
|---|---|
| Allow all | Optional categories (Preferences, Statistics, Marketing) are enabled. Your choice is stored in phm_consent for up to 365 days. |
| Deny | Only necessary cookies remain active. Your choice is stored for up to 14 days, after which the banner may appear again. |
| Customise → Confirm my choices | You choose each optional category individually. Accepted choices are stored for up to 365 days. |
Manage cookies (site menu) or #cookies URL |
Reopens the preference dialog so you can change or withdraw consent. |
Cookie used for consent: phm_consent records status=accepted or status=dismiss and, when accepted, category flags p (preferences), s (statistics), and m (marketing).
Server-side storage: When you enable Preferences or Statistics, PhMuseum may store a pseudonymous visitor profile on our servers linked to phm_preferences or phm_statistics (see below). Attribution, locale, and notice state may live there rather than in many separate browser cookies.
Legacy cookies: If you visited us before May 2026, you may briefly still see older names (cookie_status, phm_cmp, pidn, pidr, pidd). These are migrated to the new model and cleared when possible.
Required for security, session management, consent storage, and basic availability. These are not optional.
| Name | Purpose | Provider | Typical duration |
|---|---|---|---|
phmuseum_session |
Keeps you signed in and carries lightweight state between pages. | PhMuseum | ~2 hours (session) |
phm_consent |
Stores your consent response and optional category choices. | PhMuseum | Up to 365 days (accept) or 14 days (deny); see §2 |
XSRF-TOKEN |
Helps protect forms from cross-site request forgery when a session is active. | PhMuseum | ~2 hours (session) |
__cf_bm |
Cloudflare bot-management and traffic integrity signal. | Cloudflare | Short-lived (often up to ~30 minutes) |
cf_clearance |
Confirms your browser passed a Cloudflare security check when required. | Cloudflare | Per Cloudflare configuration (can be long-lived) |
_GRECAPTCHA |
Set when Google reCAPTCHA runs on registration/forms. | ~6 months (typical) | |
g_state |
Short-lived state for the Google sign-in button on registration/login. | ~6 months (typical) | |
__Secure-YEC |
YouTube embedded player consent/configuration where video is embedded. | YouTube (Google) | ~1 year (typical) |
Cloudflare Privacy Policy · Google Privacy Policy
Conveniences that shape how PhMuseum feels for you (locale, in-product notices). Not used for campaign measurement or paid social advertising tools.
| Name | Purpose | Provider | Typical duration |
|---|---|---|---|
phm_preferences |
Pseudonymous ID linking your browser to server-stored preferences (locale, currency context, notice dismissals). | PhMuseum | ~30 days |
Pseudonymous measurement to understand how visitors use the Website and to support attribution reporting.
| Name | Purpose | Provider | Typical duration |
|---|---|---|---|
phm_statistics |
Pseudonymous ID; attribution, referral, and direct-visit flag may be stored on PhMuseum servers when this category is enabled. | PhMuseum | ~5 years |
_ga |
Distinguishes visitors in Google Analytics 4. | ~13 months (typical) | |
_ga_* (e.g. _ga_*) |
Persists session/state for our GA4 property. | ~13 months (typical) |
Google Privacy Policy · Google Analytics opt-out
Advertising and conversion measurement when you enable this category.
| Name | Purpose | Provider | Typical duration |
|---|---|---|---|
_gcl_au |
Google Ads click/campaign context for conversion attribution. | ~3 months (typical) | |
_gcl_aw |
Google Ads conversion measurement support. | Per Google tag configuration | |
_fbc |
Meta click identifier from ad links for campaign attribution. | Meta | ~3 months (typical) |
_fbp |
Meta advertising delivery and measurement. | Meta | ~3 months (typical) |
Google Privacy Policy · Meta Privacy Policy · About Ads choices
When Marketing is enabled, we may also send hashed identifiers (for example email) to Google for ad measurement, only where permitted and configured—see our Privacy Policy.
Unless you Allow all or enable the relevant category, we aim not to set:
_ga, _ga_*)_gcl_au, _gcl_aw)_fbp, _fbc)phm_preferences or phm_statisticsNecessary cookies and Cloudflare security cookies may still apply. If you believe a non-essential cookie appeared before you chose, contact us (see §7).
Some third-party providers may process data outside the EEA (for example Google and Meta in the United States). Where required, transfers rely on mechanisms such as Standard Contractual Clauses and/or adequacy decisions. See our Privacy Policy and vendor terms for more detail.
You can block or delete cookies in your browser settings. Blocking all cookies (including necessary ones) may prevent you from using parts of the Website.
Withdrawing consent via our banner affects future use on the Website; it does not remove cookies already stored in your browser until you clear them or they expire.
Questions about this Cookie Policy:
Email: privacy@phmuseum.com
Post: PHmuseum Srl, Via Paolo Fabbri 10/2a, 40138 Bologna, Italy