Cookie Policy

The Platform uses strictly necessary cookies (exempt from consent under Art. 4 of Romanian Law no. 506/2004, implementing the ePrivacy Directive) and, only with your agreement given through the consent banner, analytics cookies and advertising cookies — two separate choices: you can accept both, neither, or only one of them.

• loomia_session — the session cookie that keeps you signed in. Encrypted content, inaccessible to scripts (httpOnly), transmitted securely only. Duration: approximately 14 days.
• loomia_auth — a marker telling the public pages that you are signed in, so they can show the link to your dashboard instead of the sign-in buttons. It contains exactly the value "1" — no identifier, no role, no destination — and is written only while your session is valid, and deleted the moment it is not. Duration: the same as the session (approximately 14 days).
• NEXT_LOCALE — remembers your chosen language (Romanian or English) so the Platform greets you in your language. Duration: your browsing session (deleted when the browser closes).
• loomia_consent and loomia_ads — remember your choices in the consent banner (analytics and advertising respectively: accepted or refused), so we do not ask on every visit. Duration: 180 days.
• loomia_google_oauth — exists only while you are signing in with Google: it holds, encrypted, the security elements of that sign-in (the anti-forgery value and the verification code) between pressing the button and returning from Google. Duration: 10 minutes, then deleted.
• loomia_q — set only if you opened the link to a questionnaire sent by a professional and pressed “Create an account” or “I have an account”. It holds the questionnaire’s address while you create your account, confirm your email address or sign in with Google, so that we can then take you back to it. Inaccessible to scripts (httpOnly), transmitted securely only. Deleted when you press “Start” on the questionnaire. Duration: 7 days at most.
• loomia_c — like loomia_q, for the link to a contract sent by a professional: set only if you pressed “Create an account” or “I have an account” on the contract page, it holds the contract’s address until you are signed in. Inaccessible to scripts (httpOnly), transmitted securely only. Deleted when you press “Open the contract”. Duration: 7 days at most.

We use PostHog (hosted in the EU, in Frankfurt) for usage statistics and, within the same tool, pseudonymised session replay (which pages are used and how — with all on-page text and all form fields masked automatically, so a recording shows the page's structure and actions, never its content). PostHog loads ONLY after you press "Accept" in the banner — refusing is exactly as easy as accepting, and without an explicit choice nothing loads. PostHog cookies (names starting with "ph_") and the associated browser local-storage data exist only after consent.

Guest pages (the invitation, RSVP, gift and wishlist pages) and all other pages reached through token links are never tracked or recorded and never show the banner — guests are not users of the Platform.

Separately from analytics, we use a technical error-monitoring service (Sentry, hosted in the EU) which sets no cookies, uses no browser local storage and records no sessions. It stays active on guest pages too — an invitation that fails to open on the wedding day is the most expensive failure this Platform has — and it runs on legitimate interest, not on consent. What it does and does not receive is described in the Privacy Policy.

If you choose "Advertising" in the banner, the Meta pixel (Facebook, Instagram) loads on the public pages and on the sign-up pages. It tells Meta which pages you visited and whether you created an account, so we can learn what our ads bring and show them to people they may interest. Without that consent the pixel does not load, and our server sends Meta nothing about you. What exactly Meta receives is described in the Privacy Policy.

• _fbp — set by Meta, identifies the browser across visits. Duration: 90 days.
• _fbc — set by Meta only when you arrive from an ad; it records that click. Duration: 90 days.
• loomia_signup_event — set by us only if you created your account after accepting advertising: a random event identifier, read once to report the sign-up to Meta, then deleted. Duration: one hour at most.

The pixel never loads on guest pages, in the couple's dashboard or in the professional portal. If you withdraw consent, we delete the _fbp and _fbc cookies from your browser.

Public Marketplace profiles may contain a presentation video hosted on YouTube, embedded exclusively in the player's privacy-enhanced mode (youtube-nocookie.com), which sets no cookies when the page loads. When a profile with a video is displayed, your browser still contacts YouTube (Google) servers to load the player, which makes your IP address visible to them. If you start playback, Google/YouTube's own privacy policy applies. Other video links (for example Vimeo) appear as a plain link, with no embedded content.

You can change your analytics and advertising choices at any time from the "Cookie settings" link in the footer of the public pages — the banner reappears and you can accept or refuse again. Separately, you can delete or block cookies from your browser settings. Blocking the session cookie makes signing in impossible; the public pages and invitations remain accessible. Your rights over your data, and how to exercise them, are described in the Privacy Policy.

If we ever introduce further cookie categories, we will update this policy and ask for your consent in advance through an updated banner. Questions: contact@loomia.ro.