Cookies

The short version

Cookies are small files a website asks your browser to keep. We use as few as we can get away with. The ones that sign you in, keep your uploads yours and remember a discount code are part of the service working at all, so the law does not ask you to agree to them. One cookie is different — an advertising cookie from Meta — and that one only exists if you say yes. Saying no costs you nothing: every part of GuestAlbum works the same either way.

Guests never see any of this. On an event page, a shared album or the live slideshow there is no advertising cookie, no banner and nothing sent to Meta — those pages belong to the organiser’s event, not to our marketing.

Cookies the service needs

These are set because something you asked for cannot work without them. Under PECR they are “strictly necessary”, so we do not ask permission — but here they are:

• Sign-in session (organisers) — keeps you signed in after you use your email link. Cleared when you sign out.
• ga_g_… (guests) — a random token for each event you add photos to, so your own phone can see and remove your own uploads. One per event; it lasts as long as the event does.
• ga_s_… and ga_live_… (viewers) — let you keep looking at a shared album or the live slideshow the organiser has switched on.
• ga_code — remembers a discount code you followed a link for, so it is there when you pay. One month.
• ga_consent — remembers the answer you gave to this very question, so we stop asking. It holds nothing but “yes” or “no” and lasts 6 months, after which we ask again.

We also count visits to our own pages, but with no cookie at all: the page, the day, the site you came from and a campaign code, added to a counter. Nothing identifies you or your device, so there is nothing to agree to and nothing to refuse.

The advertising cookie, if you allow it

We advertise GuestAlbum on Facebook and Instagram. To know whether that money is wasted, we use Meta’s pixel: a small script from Meta that runs on our own pages and tells Meta that a browser visited a page, and — after a payment — that an event was bought and for how much.

• _fbp — set by Meta’s script on our domain to recognise the same browser across visits. Three months.
• _fbc — set when you arrive from a Facebook or Instagram advert, recording which advert it was. Three months.
• Meta also reads its own cookies for facebook.com and instagram.com, which are Meta’s, not ours, and matches the visit to an account where it can.

What it means in practice: Meta learns that someone visited guestalbum.app and what they did there, and can connect that to their Facebook or Instagram account. We see only totals — how many people an advert brought, and how many of them bought. We never send Meta your name, your email address, your photos, your guests or anything about an event.

Nothing above happens unless you press “Yes, that’s fine”. Before that, and after you say no, nothing is requested from Meta and no advertising cookie is set.

Your choice

You can change your mind whenever you like, here. If you turn it off we clear the pixel’s cookies from our domain and reload the page without the script; cookies Meta holds on its own sites are Meta’s — change those in your Facebook or Instagram ad settings, under “Ad preferences”.

We ask again after 6 months, and whenever this list changes in a way your old answer would not have covered.

Other ways to control cookies

Your browser can block or delete cookies for any site, including ours — look for “Privacy” or “Cookies” in its settings. Blocking the strictly-necessary ones will stop you signing in or seeing your own uploads.

If your browser sends a Global Privacy Control signal — a standing “don’t share my data” you set once for every site — we take it as a no: the pixel doesn’t run and we don’t even show you the question. Turn it on in your browser’s privacy settings, or through an extension. If you would rather allow our pixel anyway, the buttons above are the exception you make.

Questions about any of this: support@guestalbum.app.