Cookie Policy

We use only technically necessary cookies and comparable browser storage technologies to provide our services. These mechanisms are required for login functionality, security, secure payment processing, and specific short-lived newsletter flows.

Essential Cookies & Storage We Use

• tdp.csrf-token: Prevents cross-site request forgery (CSRF) attacks on form submissions and API calls. Set by our server on each session and required for most mutating requests, with limited route-specific exceptions where appropriate. Expires after 24 hours. Flags: HttpOnly, SameSite=Strict, Secure.
• Stripe Session Cookie: Used during checkout to securely process payments.
• Appwrite session cookie: A secure, HTTP-only session cookie set by our authentication provider (Appwrite) to maintain your login session across page reloads. This cookie is managed by Appwrite and cannot be accessed by JavaScript. No authentication tokens are written to localStorage.
• sessionStorage (newsletter_email): Temporarily stores your newsletter email during confirmation/error handling to support resend functionality in the same browser session.
• tbdp_guest_access_[page]: Set on a couple’s wedding page after a guest opens a valid guest-upload link (for example by scanning the QR code). It maintains the guest’s upload session so they can add photos, videos and comments without signing in. Signed and tamper-protected. Expires after 24 hours. Flags: HttpOnly, Secure, SameSite=Lax.
• tbdp_guest_session_marker_[page]: A small non-HttpOnly companion value (containing only “1”) that lets the page detect whether a guest-upload session is active, without exposing any secret. Expires after 24 hours.
• localStorage (tbdp_guest_name_[page]): If a guest ticks “Remember my name on this device”, the display name they chose is stored on their own device so it can be pre-filled the next time they upload or comment on the same wedding page. If the option is left unticked, no name is stored and any previously remembered name is removed. It is never read from local storage by our servers.

With the exception of the optional 'Remember my name on this device' feature described above, these cookies and storage entries are limited to technically necessary purposes and do not require consent under applicable privacy laws (GDPR & ePrivacy Directive). The optional name-storage feature is used only if you actively enable it and can be switched off at any time by unticking the option or clearing your browser storage.

For more information about our privacy practices, please refer to our Privacy Policy.