Cookie and storage policy
Last updated: August 2026
The short version
This site is run by Ruben Cipriano, Rua André Vidal de Negreiros, 1950-024 Lisboa, Portugal, reachable at [email protected]. We use a small number of cookies and browser storage items, and every one of them is needed to make the site work. There is no advertising, no analytics, and no cross-site tracking. Everything we set is listed below.
What we store on your device
"Cookie" means a small file your browser sends back to us with each request. "localStorage" and "sessionStorage" stay in your browser and are never sent to a server — we read them in the page itself.
| Name | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
token | Us (first party) | Keeps you signed in. HttpOnly, Secure, SameSite=Lax. Strictly necessary. | Cookie | About 7 days, sliding — it resets each time you come back |
wedding_device_id | Us (first party) | Rate-limits photo uploads so a single device can't flood a gallery, and identifies which device was shown the privacy notice on the RSVP and upload forms. Strictly necessary. | localStorage | Until you clear your browser storage |
wedding_currency | Us (first party) | Remembers the currency you picked on the pricing page, so prices stay in your own money next time. Set only when you choose a currency yourself, and it holds nothing but that three-letter code. Strictly necessary. | Cookie | 1 year, or until you clear your cookies |
oauth_state | Us (first party) | Set only while you are signing in. It carries a one-time value we check when your provider sends you back, which is what stops someone else starting a sign-in in your browser. Deleted the moment sign-in finishes. Strictly necessary. | Cookie | A few minutes, and only during sign-in |
__cf_bm | Cloudflare (our CDN) | Bot management — tells real visitors apart from automated traffic. Strictly necessary. | Cookie | About 30 minutes |
_cfuvid | Cloudflare (our CDN) | Rate limiting — keeps one source from overwhelming the site. Strictly necessary. | Cookie | Session — cleared when you close the browser |
| hCaptcha cookies | Intuition Machines, Inc. (third party) | Anti-spam check on an RSVP form. Set only when the anti-spam check is switched on for the platform. Strictly necessary for spam prevention. | Cookies | Set by hCaptcha; see their cookie notice |
That's the whole list. If you block these, browsing still works, but you won't be able to stay signed in, and an RSVP form protected by hCaptcha may refuse to submit.
Why there is no cookie banner
Consent is required for cookies that aren't needed to deliver the service you asked for. Every item in the table above is needed: signing in, stopping upload abuse, not replaying an animation, keeping bots off the site, and protecting RSVP forms from spam. We run no analytics, no advertising, and no cross-site tracking, and we don't sell or share this data. So there is nothing to ask you to consent to, and we don't interrupt you with a banner. If we ever add analytics or anything else that isn't strictly necessary, a consent banner will appear first, and it will be off until you say yes.
Maps on wedding pages
If a couple adds a map to their wedding page, the map tiles are loaded from the OpenStreetMap Foundation. Loading those tiles means your browser contacts their servers directly, so they receive your IP address and browser details — we can't prevent that, and it happens as soon as the map appears. The map itself doesn't set cookies here. If you'd rather not be seen by them, avoid pages with a map, or block their domain in your browser.
Controlling this yourself
Every browser lets you view, block, and delete cookies, and clear local and session storage, usually under privacy or site settings. Clearing them signs you out and resets the two items we keep in browser storage.
Questions
Email [email protected] and we'll answer within 2 business days. Our full Privacy Policy explains everything else we do with your data, including the providers we rely on and your rights.