Cookie and Local Storage Notice

Effective: 3 October 2026Version: 1.5

All legal documents
On this page

This notice covers everything we store on your device or read back from it. The governing rule is Article 5(3) of the ePrivacy Directive as transposed into Hungarian law, which applies not only to cookies but to any information stored on terminal equipment - including browser local storage. That is why the list below contains several items most cookie notices leave out.

The In short summaries are informational and are there to help you follow the section. The full text always prevails legally.

This document is available in Hungarian and English. In case of any discrepancy, the Hungarian version prevails, except where the English version is more favourable to a Consumer.

1. Strictly necessary items

In shortNo consent is required for these because the Service will not work without them. Naming them is required, and this list is complete.

Without the items below, sign-in, security or an operation already in progress would break. The consent requirement does not extend to them; the duty to inform does.

  • Item
    Sign-in session (sb-…-auth-token, split into .0, .1 parts where needed)
    Where stored
    Cookie
    Purpose
    Keeps you signed in and refreshes the session securely (Supabase Auth). The cookie is sent only to the Service's own server.
    Lifetime
    Until the authentication token expires or you sign out
  • Item
    Wedding check cache (w_ok)
    Where stored
    Cookie
    Purpose
    Avoids a database query on every page load.
    Lifetime
    15 minutes
  • Item
    Active client (active_wedding)
    Where stored
    Cookie
    Purpose
    Planner accounts only: which client the planner is currently viewing.
    Lifetime
    Until the session ends
  • Item
    Cookie decision record
    Where stored
    Local storage
    Purpose
    Your choice and the moment you made it. Never sent to the server. This is what lets us honour and evidence the decision.
    Lifetime
    12 months, then we ask again
  • Item
    Dismissed information bars (wcp_getting_started_dismissed, wcp:lapsed-banner-dismissed)
    Where stored
    Local storage
    Purpose
    Whether you closed the getting-started bar or the expired-plan notice, so that it does not reappear. Never sent to the server.
    Lifetime
    Until you clear it
  • Item
    Guest photo upload limit (wcp_uploader_key:<collection>)
    Where stored
    Local storage
    Purpose
    On the guest photo upload page only: a random identifier, separate for each collection, so that one device cannot upload an unlimited number of photos. The server stores only a hashed form of it and does not use it for tracking.
    Lifetime
    Until you clear it
  • Item
    Selected plan (wcp_pending_plan)
    Where stored
    Local storage
    Purpose
    If you start a subscription but need to register first, we keep the plan name, and whether you asked on the pricing page for the service to start immediately, and resume checkout after sign-in.
    Lifetime
    Until checkout starts
  • Item
    Budget calculator result (wcp_pending_budget)
    Where stored
    Local storage
    Purpose
    The values from the public calculator (guest count, total, currency) so we can carry them into your wedding profile if you register. The data leaves the browser only if you register: it is then stored with your account data and removed from there once your wedding profile is created.
    Lifetime
    7 days
  • Item
    Saved checklist tool state (wcp_pending_checklist)
    Where stored
    Local storage
    Purpose
    Created only when you press Save my checklist: the IDs of the ticked tasks, the active filters and the date you entered, so that your checklist starts from it if you register and your ticks are not lost when you go back. On registration it is also stored with your account data, and removed from there once your wedding profile is created.
    Lifetime
    7 days, or until your wedding profile is created
  • Item
    Sign-up confirmation in progress (wcp_pending_signup)
    Where stored
    Session storage
    Purpose
    The email address you registered with and the time, so that a reload (for example after switching to your email app) does not remove the code entry screen before you type the confirmation code. It does not leave the browser.
    Lifetime
    Until confirmation, at most 1 hour; deleted when the browser tab is closed

2. Statistics

In shortPostHog product analytics. It writes to your device only with consent; until you decide, a narrow storage-free product event measurement runs, which declining stops immediately.

PostHog measures which features people use and where they get stuck. This informs product development, not advertising.

Until consent is given, the library loads in a mode that writes nothing to your device and reads nothing from it. In that state two things can happen: errors that break the Service are reported, and a few named product events are measured (as described in Section 2.10 of the Privacy Policy, with fingerprint-like attributes filtered and no IP storage) - both without any persistent identifier, on the basis of legitimate interest. Choosing Only the necessary stops the product event measurement immediately, as an objection. After consent the full measurement runs, and PostHog stores an identifier that lets a returning visit be recognised: a ph_<project key>_posthog cookie and a local storage item of the same name, for up to 12 months. Withdrawing consent deletes them.

Vercel Web Analytics counts page visits in aggregate without writing to or reading from your device (Privacy Policy Section 2.11). It runs before your decision on the basis of legitimate interest, and choosing Only the necessary stops it from the next page view.

PostHog runs in identified mode only: it does not track anonymous visitors, and records only in-app events of signed-in users. Details are on the subprocessor list.

3. Marketing measurement (consent required)

In shortGoogle Analytics 4 and the Meta advertising pixel. Without consent neither loads and not a single request goes out to them.
  • Tool
    Google Analytics 4
    What it measures
    Where visitors come from (organic search, ads, referring sites) and which pages they open.
    Without consent
    Does not load. The Service uses Google Consent Mode v2.
  • Tool
    Meta advertising pixel
    What it measures
    Effectiveness of Facebook and Instagram ads (for example whether a visitor from an ad created an account) and retargeting.
    Without consent
    Does not load, and no request reaches Meta.

Pages whose URL carries an invitation or upload token (guest page, RSVP, guest photo upload, shared link) are excluded from measurement, and page titles are transmitted with the token stripped. This matters because the token is itself personal-data-like: it identifies the guest it belongs to.

With consent, Google Analytics 4 sets the _ga and _ga_<measurement ID> cookies (up to 2 years), and the Meta pixel the _fbp cookie (90 days) and, when you arrive from an ad, _fbc (90 days). Withdrawing consent deletes them from the Service's domain.

4. Your choice and withdrawal

In shortRejecting is exactly as easy as accepting, and consent can be withdrawn at any time from the footer or from your settings.

On the consent bar both buttons appear side by side with equal weight: there is no highlighted Accept and hidden reject. Until you decide, nothing is written to or read from your device beyond the strictly necessary items in Section 1; only the two storage-free measurements described in Section 2 run, and choosing Only the necessary stops them.

Consent can be withdrawn at any time through the Cookie settings link in the footer, and while signed in through the privacy card on the Settings page. Article 7(3) GDPR requires withdrawal to be as easy as giving consent, which is why it is reachable from inside the app and not only from the public footer.

Withdrawal takes effect immediately: the page reloads so that already-loaded measurement scripts stop, and cookies set on the apex domain are removed.

5. Browser settings and automated signals

In shortYou can also restrict cookies in your browser, but blocking the strictly necessary items will stop parts of the Service from working.

Every mainstream browser lets you restrict or delete cookies. If you also block the strictly necessary items, sign-in and saving will not work - that is a consequence of the setting, not a fault.

The Service currently does not act on automated browser signals (Do Not Track, Global Privacy Control), because consent is collected per category through an explicit decision, and before that decision nothing beyond the strictly necessary items is stored on your device. If this changes, this section will be updated.

If we introduce a new measurement tool in the future, consent is requested again immediately and this notice is updated before the tool goes live.