Cookie Policy

Last updated: 18 August 2026

This policy explains how Wedding List Manager uses cookies and similar technologies, what each one does, and how you can change your choices. It sits alongside our privacy policy.

What Cookies Are

Cookies are small text files a website stores on your device. We also use your browser's local storage, which works in a similar way. Both are covered by this policy.

Your Choices

When you first visit, we ask whether you accept optional analytics cookies. Until you accept, no analytics cookie is set and Google's tag is not even downloaded — there is nothing to opt out of, because nothing has started. Declining does not limit any part of the planning tools.

You can change your answer whenever you like by using the “Cookie settings” link in the footer of any page.

We ask again every 12 months, and any time we materially change what we measure, so a choice you made long ago is never treated as permission for something new.

Essential cookies cannot be switched off, because the site cannot keep you securely signed in without them.

Cookies We Use

Essential

• Session cookie (wedding-list-manager-session) — keeps you signed in as you move between pages. Expires when your session ends or after a period of inactivity.
• CSRF token (XSRF-TOKEN) — protects forms against cross-site request forgery, so another site cannot submit actions on your behalf. Expires with your session.
• Cookie choice (wlm_cookie_consent) — remembers whether you accepted or declined analytics, so we do not ask again on every visit. Stored in your browser's local storage and re-checked after 12 months.
• Guest portal access — when a guest opens an invitation link, a short-lived session record remembers that the invitation token was verified.

Analytics (optional — only with your consent)

If you accept, we load Google Analytics 4. It sets these cookies:

• _ga — distinguishes one browser from another so repeat visits are not counted as new people. Expires after 2 years.
• _ga_<property> — keeps track of the current visit (which page you arrived on, how long you stayed). Expires after 2 years.

Where we load Google Tag Manager, it is only the container that delivers the analytics tag above; Tag Manager sets no cookies of its own.

What Analytics Measures

We use analytics to understand the journey through the product, not just page counts: which page you arrived on, the order you visit pages in, where you drop out of a flow such as registration or building a guest list, which features get used, and roughly where in the world you are (country and region, from your IP address). This includes pages inside your account once you are signed in, not only the public marketing pages.

Alongside page views we record a short, fixed list of milestones: creating an account, finishing setup, a supplier publishing their listing, sending an enquiry, saving a supplier to your favourites, sending guest invitations, and a supplier buying tokens. Each carries only the bare fact and a category or a count — never a name, an address, a message, or anything you or your guests typed.

We do this to find the steps people get stuck on and fix them. Specifically:

• We do not send your name, email address, or any wedding, guest, or vendor detail to Google.
• We do not use analytics for advertising, remarketing, or to build profiles — Google's advertising and personalisation features stay switched off.
• Google Analytics 4 does not log or store IP addresses; your IP is used in transit to derive an approximate location and is then discarded.

Joining Up Your Visits

If you have accepted analytics and you are signed in, we send Google a code that stands for your account, so that visits from your laptop and your phone are recognised as one person rather than two. Without it, someone who starts a guest list on a train and finishes it at home looks like two people who each gave up halfway, and we would keep “fixing” problems that are not real.

That code is not your name, your email address, or the ID we hold in our own database. It is a one-way cryptographic hash, unique to this site, and Google cannot work backwards from it to you. We can go the other way — from an account we already know to its code — which is what lets us investigate a problem you report to us.

It is only ever sent when you have accepted analytics. If you decline, or later withdraw, the code is dropped along with the cookies.

Signed-out visitors, and guests using an invitation link, are never given one.

Google acts as our data processor for this, and may process the data outside the UK under the UK extension to the EU–US Data Privacy Framework and standard contractual clauses. Their own privacy policy describes how they handle it. We keep analytics data for no longer than 14 months, after which Google deletes it.

What We Do Not Do

We do not use advertising cookies, and we do not build advertising profiles from your browsing.

We also do not sell your personal data. Vendors pay us to send messages to couples who match what they are looking for — but we send those messages, and vendors never receive your name, email address, or browsing data. Campaign targeting uses only the wedding details you chose to share (location, wedding date, budget range, and service interests), and only if you opted in to marketing in your notification preferences. Vendors can see how many people opened a campaign, never who. A vendor only learns who you are if you contact them, reply to them, or book them.

Nothing we measure with analytics is used to target you with vendor marketing.

Wedding Websites

Public wedding websites hosted by couples on our platform use only essential cookies, such as the one that remembers a password-protected site has been unlocked.

Contact

If you have questions about this policy, contact us at privacy@weddinglistmanager.co.uk.