Effective date: June 2, 2026 · Last updated: October 14, 2026
1. Introduction
This Cookie Policy explains how Invitarium, LLC ("Invitarium", "we", "us", or "our") uses cookies and similar technologies on the Invitarium website at invitarium.io, the Invitarium application at app.invitarium.io, and the guest pages we publish for our users at *.invitarium.site or other custom domains (collectively, the "Service").
This policy supplements our Privacy Policy and uses the same definitions.
2. What are cookies
Cookies are small text files placed on your device by a website to store information between visits or between page loads. Some cookies are set by the site you are visiting (first-party cookies) and some are set by other domains the site relies on (third-party cookies).
We also use technologies that work similarly to cookies, such as localStorage and sessionStorage, to remember your preferences inside the editor and dashboard. For brevity we refer to all of these as "cookies" in this policy.
3. Cookies we use
We use cookies sparingly. Most of them are essential for the Service to work. We do not use advertising cookies and we do not allow third-party advertisers to track you across our Service.
3.1 Strictly necessary cookies
These cookies are required for the Service to function. They cannot be turned off without breaking sign-in, billing, or security.
authjs.session-token (and the "__Secure-" prefixed variant on HTTPS). Set by our authentication library (Auth.js / NextAuth.js) to keep you signed in. HttpOnly, Secure, SameSite=Lax. Expires when the session ends or after thirty (30) days of inactivity.
authjs.csrf-token. Used by Auth.js to protect sign-in requests from cross-site request forgery.
authjs.callback-url. Remembers where to send you after a successful sign-in.
inv_csrf. Our own cross-site-request-forgery cookie. Set on first visit and read by our API to verify that POST requests originate from your active session.
inv_device. Our first-party account-security cookie, created when you start email or Google sign-in. It contains a random identifier that lets us identify registered accounts that use the same browser for manual fraud and abuse review. The cookie contains no name, email, IP address, or browser fingerprint. It is HttpOnly, Secure on HTTPS, SameSite=Lax, and expires after twelve (12) months.
INVITE_COOKIE. Set when you open a folder invite link as a guest. Holds the share-URL token and visit identifier until you finish signing up or signing in, then cleared.
legacy-migration-link-token and legacy-migration-origin. Stored in sessionStorage when you choose to connect a Legacy Invitarium account. They keep the signed connection handoff and verified Legacy origin available if sign-in or account selection interrupts the flow. The token is removed after a successful connection; the origin remains only for the current browser-tab session or until it is replaced. They are not used for advertising or cross-site tracking.
3.2 Functional storage
We use browser localStorage to remember preferences that improve your experience but are not required for the Service to work. Examples include the dismissal state of one-time intro banners (such as the Assets banner), the active tab on multi-tab dashboards, and a cached snapshot of your billing summary so the Settings page renders faster.
NEXT_LOCALE is a first-party preference cookie set when you choose an interface language. It is used only to display the Service in the language you requested, including on routes where an account lookup is not performed. It uses SameSite=Lax, applies across the Service, and expires after one (1) year. You can replace it by choosing another available language or remove it through your browser settings.
3.3 Analytics
Our first-party landing statistics do not set or read a cookie, localStorage value, or other browser identifier. A page view or link click sends only normalized page and destination paths to our own server. The server creates a keyed one-way visitor pseudonym from connection data already sent with the request, then discards the source values from the analytics event. URL query strings and link text are not recorded.
We may add a privacy-respecting analytics provider (such as Plausible or PostHog) before commercial launch so we can understand which features are used and where the Service can be improved. When we do, we will list the specific cookies or identifiers here and update the Privacy Policy. We will not use any analytics provider that builds personal advertising profiles.
3.4 Error monitoring
We use Sentry on the production application to capture unhandled errors. The Sentry SDK stores an anonymous client identifier in your browser’s local storage (not a cookie) so repeated reports from the same browser can be grouped together. The identifier carries no name, email, or other personal data. The SDK is disabled in development and on environments without a Sentry DSN. See section 5.1 of the Privacy Policy for the data the SDK sends and Sentry’s own policy at sentry.io/privacy.
4. Third-party cookies
Some pages of the Service rely on cookies set by third parties we work with. These are independent operators and their cookies are governed by their own policies.
Google may set cookies during the Google sign-in flow, inside the Map widget, and when Calendar-page address suggestions load. See Google's cookie policy.
Stripe sets cookies when you reach a Stripe Checkout page, hosted invoice or receipt page, or the Stripe Customer Portal. See Stripe's cookie settings.
Cloudflare may set a security cookie ("__cf_bm") on guest pages served through Cloudflare to distinguish humans from automated traffic. See Cloudflare's cookie policy.
5. Managing cookies
You can manage cookies through your browser settings. Most browsers let you block all cookies, block third-party cookies only, or clear cookies on exit. Blocking the strictly necessary cookies listed in section 3.1 will prevent you from signing in and using paid features.
We show a cookie consent banner on your first visit that lets you accept all cookies, reject non-essential cookies, or open the preferences dialog to choose category by category. We respect your choice across the Service. You can change your mind at any time by using the button below.
6. Do Not Track
Some browsers send a "Do Not Track" signal. There is no industry consensus on how to interpret it, so we do not currently respond to those signals. We will revisit this if a consistent standard is adopted.
7. Changes to this policy
We may update this Cookie Policy from time to time. If we make material changes we will notify you by email and post the updated policy on this page at least thirty (30) days before the changes take effect. The "Effective date" and "Last updated" dates at the top of this page tell you when the policy was last revised.
8. Contact us
For any question about this Cookie Policy, contact us at:
