Cookies Policy

Cookies Policy

This Cookies Policy explains how United Vows LLC ("United Vows," "we," "us") uses cookies and similar technologies on our website and platform. It supplements our Privacy Policy at unitedvows.com/privacy. By using United Vows, you agree to the use of cookies as described in this policy, subject to your right to opt out of non-essential cookies as described below.

1. What are cookies?

Cookies are small text files placed on your device when you visit a website. They are used to store information about your interactions with a site, for example, whether you're logged in, what language you prefer, or which pages you've visited. Cookies are commonly categorized as "first-party" (set by the website you're visiting) or "third-party" (set by services embedded in the site, such as analytics or payment processors).

This policy also covers similar technologies: local storage, session storage, and pixel tags. These work similarly to cookies but use different mechanisms.

2. Categories of cookies we use

2.1 Strictly necessary cookies

These cookies are required for the platform to function. They cannot be disabled because the platform would not work without them. Examples include:

• Authentication / session cookies (authjs.session-token, its __Secure- prefixed form and its split-chunk variants, up to 30 days): keep you logged in across pages.
• Security cookies: CSRF protection, rate-limit enforcement, fraud-prevention signals.
• Load-balancing cookies: route your request to the correct server.
• uv_onboard_draft_device (local storage, 7 days): set only if, while building your plan before you have an account, you tick "Keep my answers on this device for 7 days". It holds the answers you have given so far (such as your names, date, city and budget) so they are still there if you close the tab and come back. It stays in your browser and is not sent to us. It is deleted 7 days after your last visit to that page, when you create your account, when you start over, or when you choose "Clear my answers from this device". Without that tick, your answers are kept only in that tab's session storage and are gone when you close it.
• uv-cookie-decision and uv-cookie-prefs (first-party, 1 year): record that you answered the cookie banner and which categories you allowed. They are how your answer survives the next page load, so they are set whatever you choose — including when you refuse everything optional.
• uv-gpc (first-party, 1 year): records that your browser sent a Global Privacy Control signal, so we keep honoring it after you navigate away from the page it arrived on.
• uv_opt_out (first-party, 2 years): records that you used the privacy preferences page to opt out of the sale or sharing of your personal information. Kept for two years so we can show the opt-out was honored.
• NEXT_LOCALE (first-party, 1 year): your language choice. It is set when you pick a language with the language switcher, and also when you sign in on a device where you have not chosen one and your account has a saved language, so your account opens in the language you chose on another device. It holds nothing but the language code; without it the interface resets to English on the next page.
• uv_app (first-party, 1 year): set only if you opened United Vows through our app shell rather than an ordinary browser tab. It records that one fact so the layout stays right on later visits (iPad desktop mode erases the signal we would otherwise read from the browser itself). It holds a single yes value, identifies nobody, and is never used for analytics.
• uv_favor_code (first-party, 14 days): set only when you scan or open a wedding guest-favor QR code. It carries that code through sign-up so the couple who shared it is credited even if you sign up with Google instead of the on-page form — the code is otherwise lost the moment that flow leaves our site. It holds no identifier besides the code itself. Once the code has been redeemed nothing reads it again, and the cookie expires on its own 14 days after it was set; we do not delete it earlier than that.

2.2 Functional cookies

These cookies would remember preferences and choices beyond what the platform needs in order to run — a theme, a saved dashboard layout, recently viewed vendors.

We do not currently set any functional cookies. Under the Functional toggle we store one item in your browser's local storage, and only if you have turned Functional on: "uv:session-visits", a count of how many times you have opened the site, used only to decide when to offer "add to home screen". It never leaves your device. If Functional is off, the count is kept in memory for that page view only and nothing is written. The one preference stored on your device, the language you choose with the language switcher, is listed under strictly necessary above: we set it only because of a language choice you made, on this device or in your account, and the interface cannot honor your choice on the next page without it. The Functional toggle in our cookie banner and preference centre therefore governs no cookies today, only the local-storage item above. We would update this policy before setting anything else under it. Other preferences — a dashboard layout, an onboarding step you have finished — are stored in your account or in your browser's local storage, not in a cookie.

2.3 Analytics cookies

These cookies help us understand how users interact with the platform so we can improve it. We use:

• PostHog: aggregated product analytics (page views, feature usage, click paths). Until you accept analytics cookies (and, if you are in the EEA, the United Kingdom or Switzerland, or we cannot tell where you are, not even then: see the paragraph below), PostHog sets no cookie and stores nothing on your device: it counts the visit and records which pages and steps it reached (for example, how far through sign-up it got) anonymously, using an identifier PostHog computes on its own servers from your IP address and browser details with a salt that changes every day, so a visit cannot be linked to you or followed from one day to the next. Nothing you type into a form, such as your name or email, is included, and we remove email addresses and one-time links from page addresses before anything is sent. Every counted visit, with or without analytics cookies, also carries the country and US state our hosting provider derives from the request. For a visit counted without analytics cookies, PostHog uses your IP address only to compute that daily identifier and does not store it with the visit. Once you accept analytics cookies, PostHog also records your IP address and the approximate location (down to city level) it derives from it. If your browser sends a Do Not Track or Global Privacy Control signal, or you have turned on the account-wide opt-out, we do not count the visit at all.
• Google Analytics (Google LLC): when configured, aggregated site-usage measurement (pages viewed, approximate location, device and browser information, which page or campaign brought you here). Loaded only after you accept analytics cookies, using Google's Consent Mode: until you accept, no Google Analytics cookie is set and no analytics data is sent to Google. See policies.google.com/privacy for Google's own privacy policy.
• Vercel Web Analytics: a cookieless count of page views and the site or campaign that referred them. It sets no cookie and stores nothing on your device. It is not loaded if your browser sends a Do Not Track or Global Privacy Control signal, and, if you are in the EEA, the United Kingdom or Switzerland, or we cannot tell where you are, it is not loaded until you accept analytics cookies (see the paragraph on visitors in those regions below).
• Sentry: error monitoring, not analytics. It sets no cookie and stores nothing on your device, and it runs whatever you choose in the cookie banner, because it is how we find and fix errors. When an error occurs, it sends us technical context to help us debug, such as the error itself, the page address, and your browser and device type.
• uv_first_touch (first-party, 90 days): records the link, search, or campaign that brought you to United Vows, plus the page you landed on and when. This lets us tell which of our own pages and posts actually reach couples and vendors. It holds no identifier and no fingerprint, it is never shared with an advertising network, and it is set only once you have accepted analytics cookies.
• uv_last_touch (first-party, 90 days): records the most recent campaign link you followed to United Vows, so a return visit through one of our own emails or posts is not attributed to the very first link you ever clicked. Same contents and same rules as uv_first_touch: no identifier, no fingerprint, never shared with an advertising network, and set only once you have accepted analytics cookies.
• uv_vendor_referrer (first-party, 12 months): set when you follow another vendor's personal invite link to United Vows, so that if you finish setting up your own vendor listing — even in a later visit — the vendor who invited you is credited for the referral. It is never set on an invite link pointed at the couple's signup flow, it is deleted once the referral is recorded, and it is set only once you have accepted analytics cookies. Declining analytics cookies (or a Do Not Track / Global Privacy Control signal) means we cannot connect a signup that happens after you leave and come back to the invite you followed; the "you were invited by ___" banner shown on your arrival still works either way, since that is resolved from the link itself, not from this cookie. If you accept analytics on the page the invite link brings you to, we set it then; if you later switch analytics off in the preference centre, we delete it.

Session recording on sign-up pages. If you have accepted analytics cookies, we record your session (a replay of what the page shows and how you move through it) on our sign-up pages only: /onboard, /auth/signup, /vendor/join and the wedding request form. We use this to find where sign-up is confusing. Everything you type into a field is masked and never captured, text inside form fields is masked, and we do not capture network request or response contents. Recording starts when you open one of those pages and stops when you leave it. It never runs before you accept analytics cookies, never for a visitor who has not, and never when your browser sends a Do Not Track or Global Privacy Control signal or your account has opted out of sale and sharing. Withdrawing analytics consent stops it.

Visitors in the EEA, the United Kingdom and Switzerland. If you are visiting from the European Economic Area, the United Kingdom (including the Isle of Man, Jersey, Guernsey and Gibraltar) or Switzerland, or if we cannot tell where you are, we do not count your visit at all before you accept analytics cookies: PostHog is not started, Vercel Web Analytics is not loaded, and no anonymous or cookieless page view or step is recorded. Once you accept, analytics work as described above. We make this decision in your browser from the country our hosting provider derives from your request (the same country-level lookup described in the Privacy Policy); the lookup is not stored, and no IP address is kept. The anonymous count described above applies only to visitors elsewhere.

Analytics cookies are set only after you have consented through the cookie banner, except where your browser is sending a Do Not Track (DNT) or Global Privacy Control (GPC) signal, in which case we treat the signal as a refusal of consent and do not set these cookies.

2.4 Marketing cookies

• Google Ads (Google LLC): when our team has configured a Google Ads account, conversion-tracking cookies (such as _gcl_au) measure whether a visitor who clicked one of our ads went on to complete a key action, like creating an account. We use this only to measure ad performance — we do not use it to build an advertising profile of you or to show you ads on other sites. It is loaded only after you accept marketing cookies through the cookie preference center, using Google's Consent Mode: until you accept, no Google Ads cookie is set and nothing is sent to Google Ads. This capability may be off entirely if our team has not configured a Google Ads account; you can confirm current status by asking privacy@unitedvows.com.

Accepting marketing cookies when Google Ads is configured may constitute "sharing" of personal information (such as a click identifier) with Google for cross-context behavioral-advertising measurement purposes under California law — see Section 6 for your opt-out right. We do not otherwise use marketing or advertising cookies, and we do not sell personal information.

3. Third-party cookies and requests made by integrated services

Some pages and features set cookies, or send a request directly to a third party, on your behalf:

• Stripe: when you make a payment, Stripe sets cookies for fraud prevention and PCI compliance. See Stripe's cookies policy at stripe.com/cookies-policy.
• OAuth providers (Google, Microsoft): when you sign in via OAuth, the provider may set cookies for the authentication flow.
• Google Fonts: every page loads its typefaces directly from Google's font delivery network (fonts.googleapis.com and fonts.gstatic.com) rather than from our own servers, so your browser makes that request to Google before a cookie banner can appear. Like any request to any server, it discloses your IP address and browser user-agent to Google; Google's font-serving endpoints do not set a cookie. See Google's privacy policy at policies.google.com/privacy.

Cookies set this way are governed by the third party's own cookies policy.

4. Cookie lifespans

• Session cookies are deleted when you close your browser.
• Persistent cookies remain on your device for the period specified by the cookie issuer. Most United Vows persistent cookies expire within 1 year; security and authentication cookies may have shorter lifespans (15 minutes to 30 days depending on context).

5. Managing your cookie preferences

On the platform: when you first visit United Vows, you will be presented with a cookie banner allowing you to accept or refuse non-essential cookies. You can change your preferences at any time by visiting the cookie preference center linked from the footer of every page.

Browser settings: most browsers allow you to refuse cookies, delete cookies after each session, or notify you before a cookie is set. Browser settings are typically found in "Privacy" or "Security" preferences. Blocking strictly necessary cookies will prevent the platform from working.

Do Not Track / Global Privacy Control: we honor DNT and GPC browser signals as refusals of consent for non-essential cookies. If your browser sends either signal, we treat it as opt-out.

6. Specific categories of users

California users: under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), you have the right to opt out of "sharing" of personal information for cross-context behavioral advertising. Rejecting marketing cookies in the cookie banner or the cookie preference center is how you exercise that right on this site — it fully blocks the Google Ads conversion tracking described in Section 2.4, if and when it is configured. To confirm current status or to make a deletion request, email privacy@unitedvows.com.

EU/EEA/UK users: under the ePrivacy Directive and GDPR, we will set non-essential cookies only with your explicit prior consent. The cookie banner you see at first visit captures that consent on a per-category basis. You can withdraw consent at any time through the cookie preference center.

7. Changes to this policy

We may update this Cookies Policy occasionally to reflect changes in the cookies we use, the law, or our practices. Material changes will be communicated through the cookie banner upon your next visit after the change.

8. Contact

Privacy and cookies questions: privacy@unitedvows.com.