Cookie policy

1. What cookies are

Cookies are small pieces of information stored by your browser. Golden Hour uses them to keep you signed in and support event access. Other browser storage remembers preferences, unfinished event drafts and how far an unfinished photo upload got.

2. Cookies we use

Account session cookie: ss_session

Purpose: keeps an account signed in and protects account-only pages. Typical duration: up to 30 days. It is marked HttpOnly, Secure in production, and SameSite Lax. The service cannot provide signed-in features without it.

Legacy attendee session cookie: ss_attendee

Purpose: temporarily preserves sessions created before account and attendee sign-in were consolidated. Typical duration: no longer than the old 30-day session period. It is read only when the current session cookie is absent and is then replaced. It should disappear after the migration period.

Participant event cookie: ss_p_<event>

Purpose: remembers which participant is opening a particular event or delivery link. Typical duration: up to 180 days. It is marked HttpOnly, Secure in production, and SameSite Lax. Removing it may require the person to sign in or use a valid event link again.

Google sign-in state cookie: ss_oauth

Purpose: prevents sign-in request forgery and returns the person to the intended local page when optional Google sign-in is enabled. Duration: up to 10 minutes and deleted after the callback.

3. Other browser storage

• gh-theme in local storage: remembers the day or night display preference until the user clears it.
• Temporary event-composer session storage: preserves an unfinished event draft within the browser session and removes it after successful creation.
• Temporary photo-upload session storage: keeps only how many photos an unfinished upload has confirmed, so a reloaded page can say how far it got. It stays within the browser session and is removed when the upload finishes, is stopped or the reminder is dismissed.

4. Analytics, advertising, and embedded content

As of the effective date, the product code does not load an analytics service, advertising pixel, behavioural tracker, social-media widget, or third-party iframe. It does not use cookies to build advertising profiles. Build-time font and face-model downloads are not browser trackers.

5. Is a cookie banner required?

We currently use necessary cookies and browser storage, with no advertising or analytics trackers.

If analytics, advertising, session replay, cross-site measurement, or another non-essential technology is added, it must remain off until any required consent is obtained. This policy and the consent controls must be updated before that technology is released.

6. Browser controls

A user can clear or block cookies in browser settings. Blocking necessary cookies may prevent sign-in, private-gallery access, Google authentication, and other account features. Theme, draft and upload storage can also be cleared through the browser's site-data controls.

7. Privacy choices

Cookies are only one part of data processing. See the privacy policy for information about accounts, event media, face matching, retention, and deletion.

8. Contact