Cookie Policy
Last updated: 2026-07-10
This Cookie Policy explains how Imago Club SRL(“ImagoMoments”, “we”) uses cookies and similar technologies on the Service.
1. What are cookies
Cookies are small text files placed on your device by a website you visit. They allow the site to remember information about your visit, such as whether you are signed in or what language you prefer.
2. Legal framework
This policy is issued under Directive 2002/58/EC (ePrivacy) Art. 5(3), transposed into Romanian law by Law 506/2004, which requires informed consent before storing or accessing information on a user's device, with an exemption for cookies that are strictly necessary to provide a service the user has explicitly requested. Where cookies process Personal Data we also rely on GDPR Art. 6(1).
3. Cookies we set
| Name | Purpose | Duration | Strictly necessary? |
|---|---|---|---|
__session | Encrypted authentication session (Cognito tokens, user profile, CSRF token, role) | 30 days | Yes |
__session.0 … __session.N | Overflow chunks of __session when the sealed payload exceeds ~3800 bytes per cookie (up to ~5 chunks) | 30 days | Yes |
__csrf | CSRF double-submit token, matched against the value sealed inside __session for state-changing requests | 30 days | Yes |
__oauth_nonce | Anti-CSRF nonce for OAuth sign-in; cleared after the OAuth callback completes | Session | Yes |
__invite_token | Carries an invite token across sign-in or sign-up so the post-auth redirect lands on the correct invitation | ~1 hour | Yes (functional) |
__partner_intent | Sealed cookie carrying partner-onboarding intent across the auth flow | 30 minutes | Yes (functional) |
__pending_invitation_* | Sealed cookie carrying a pending-invitation payload across sign-up (one per draft) | 60 minutes | Yes (functional) |
__return_to | Allowlist-guarded post-login redirect target | 15 minutes | Yes (functional) |
cookie_banner_dismissed† | Legacy flag set by the pre-update cookie banner. Retained for backward-compatibility — the new banner ignores it and re-shows for users who never made an analytics choice. | Persistent (until cleared by the user via browser site-data settings) | Borderline — counsel-confirmed under ePrivacy Art. 5(3) |
imago_cookie_consent† | Records your explicit consent choice from the cookie banner: { analytics: boolean, marketing: boolean, timestamp }. Read by the GA4 loader to decide whether to load tracking scripts. | Persistent (until cleared by the user via browser site-data settings) | Strictly-necessary — stores your own consent decision |
imago_first_event_redirect:*† | Remembers that we already offered a new account the event-creation form once, so you are not sent there again (one entry per account signed in on this browser). | Persistent (until cleared by the user via browser site-data settings) | Strictly-necessary — a UI one-shot, no tracking |
_ga | Optional — Google Analytics 4 user identifier. Set ONLY after you click "Accept all". Used by GA4 to distinguish unique users (IP-anonymized). | 2 years (set by Google) | Behavioural analytics — requires opt-in consent (§4) |
_ga_* | Optional — Google Analytics 4 session state (one per GA property). Set ONLY after you click "Accept all". | 2 years (set by Google) | Behavioural analytics — requires opt-in consent (§4) |
_gcl_* | Optional — Google Ads conversion measurement (click identifiers such as _gcl_au), used to attribute a sign-up or purchase to the ad that led to it. Set ONLY after you click "Accept all". | 90 days (set by Google) | Advertising measurement — requires opt-in consent (§4) |
† cookie_banner_dismissed, imago_cookie_consent and imago_first_event_redirect:* are browser localStorageentries, not HTTP cookies; they are included here because ePrivacy Art. 5(3) covers any storage of, or access to, information stored on a user's terminal equipment, which includes localStorage. The Google cookies above (_ga, _ga_*, _gcl_*) are real HTTP cookies set by Google's tag on your browser, but only after you opt in.
We do not set profiling cookies or cookies for third-party advertising networks. The only optional cookies are the GA4 analytics cookies and the Google Ads conversion-measurement cookies above, and both are set strictly on opt-in via the cookie banner.
4. Third-party scripts
The third-party browser scripts the Service may load are Google Maps Places API(always, gated on authenticated editor surfaces — see below) and, optionally, Google Analytics 4 and Google Ads conversion measurement via the Google tag (gtag.js, served from the googletagmanager.comdomain — we do NOT load a Google Tag Manager container), only after you grant consent through the cookie banner — see "Google Analytics 4 and Google Ads" below.
Google Maps Places API is loaded via @googlemaps/js-api-loader only on authenticated editor pages (the invitation editor and template editor), and only after you explicitly engage with a place-search affordance. Public invite pages displayed to unauthenticated guests do notload any Google script — venue navigation buttons are external links to Google Maps / Waze / Apple Maps; clicking them takes you to the third-party site under that site's own privacy terms. Loading the Places script may cause Google to set cookies on the google.com domain. We do not set those cookies on our own domain. Because the script loads only on authenticated editor surfaces and only after explicit user engagement, we rely on the ePrivacy Art. 5(3) strictly-necessary exemption (the user has explicitly requested the place-search service).
We do not load any of the following: Google Tag Manager, Sentry, Mixpanel, Hotjar, Intercom, Facebook Pixel, Segment, LinkedIn Insight, or any other behavioural analytics or marketing SDK.
Google Analytics 4 and Google Ads (optional, opt-in only):If the operator has configured a measurement ID, the cookie banner offers an "Accept all" choice. Only when you click that button do we load https://www.googletagmanager.com/gtag/js with IP anonymization enabled (anonymize_ip: true). The script then sets the standard GA4 cookies (_ga, _ga_*) under your browser's domain, and the same Google tag measures Google Ads conversions (attributing a sign-up or purchase to the ad that led to it) and may set the Google Ads click-identifier cookies (_gcl_*). If you decline or never make a choice, the Google tag is not loaded and none of these cookies are set. You can withdraw consent at any time by clearing imago_cookie_consentin your browser's localStorage; loading then stops on the next page navigation.
5. Consent management
Imago Club SRL displays a cookie banner on first visit with two explicit choices: "Essential only" (refuses all optional cookies) and "Accept all" (grants the optional analytics and ad-measurement cookies per §4 above). Your choice is stored in imago_cookie_consent(with the timestamp) in your browser's localStorage, and the banner is hidden afterwards (cookie_banner_dismissedflag). We rely on the ePrivacy Art. 5(3) strictly-necessary exemption for the cookies listed in §3 above. Third-party scripts that may set cookies (Google Maps) are not loaded until you actively interact with them. You can clear both localStorage keys at any time from your browser's site-data settings to re-show the banner.
6. Server-side analytics (no cookies)
Invitation analytics are collected on the server with no cookies. We record four event types (view, share, rsvp_start,rsvp_complete), together with a SHA-256 hash of the viewer's IP address, a timestamp, the referrer truncated to 255 characters, and the user-agent truncated to 512 characters. A 60-second deduplication window is applied per combination of invitation, IP hash and event type. Analytics are retained for 24 months.
7. Controlling cookies
You can control cookies through your browser settings. Most browsers let you view, delete and block cookies. Useful links:
- Chrome — https://support.google.com/chrome/answer/95647
- Firefox — https://support.mozilla.org/kb/cookies
- Safari — https://support.apple.com/guide/safari/manage-cookies-sfri11471
- Edge — https://support.microsoft.com/microsoft-edge
If you reject __session or __csrf, you will not be able to sign in or use authenticated areas of the Service.
8. Changes to this Cookie Policy
We will publish updates to this Cookie Policy at this URL. Material changes will be reflected in the “Last updated” date and version. We aim to provide advance notice of material changes when we have an in-app mechanism to do so.
In case of any conflict between the Romanian and English versions of this document, the Romanian version prevails for all consumers domiciled in Romania.
9. Contact
privacy@imagomoments.ro — see also our Privacy Policy.