Invitarium

Cookie Policy

Effective date: June 2, 2026  ·  Last updated: June 2, 2026

1. Introduction

This Cookie Policy explains how Invitarium, LLC ("Invitarium", "we", "us", or "our") uses cookies and similar technologies on the Invitarium website at invitarium.io, the Invitarium application at app.invitarium.io, and the guest pages we publish for our users at *.invitarium.site or other custom domains (collectively, the "Service").

This policy supplements our Privacy Policy and uses the same definitions.

2. What are cookies

Cookies are small text files placed on your device by a website to store information between visits or between page loads. Some cookies are set by the site you are visiting (first-party cookies) and some are set by other domains the site relies on (third-party cookies).

We also use technologies that work similarly to cookies, such as localStorage and sessionStorage, to remember your preferences inside the editor and dashboard. For brevity we refer to all of these as "cookies" in this policy.

3. Cookies we use

We use cookies sparingly. Most of them are essential for the Service to work. We do not use advertising cookies and we do not allow third-party advertisers to track you across our Service.

3.1 Strictly necessary cookies

These cookies are required for the Service to function. They cannot be turned off without breaking sign-in, billing, or security.

  • authjs.session-token (and the "__Secure-" prefixed variant on HTTPS). Set by our authentication library (Auth.js / NextAuth.js) to keep you signed in. HttpOnly, Secure, SameSite=Lax. Expires when the session ends or after thirty (30) days of inactivity.
  • authjs.csrf-token. Used by Auth.js to protect sign-in requests from cross-site request forgery.
  • authjs.callback-url. Remembers where to send you after a successful sign-in.
  • inv_csrf. Our own cross-site-request-forgery cookie. Set on first visit and read by our API to verify that POST requests originate from your active session.
  • INVITE_COOKIE. Set when you open a folder invite link as a guest. Holds the share-URL token and visit identifier until you finish signing up or signing in, then cleared.

3.2 Functional storage

We use browser localStorage to remember preferences that improve your experience but are not required for the Service to work. Examples include the dismissal state of one-time intro banners (such as the Assets banner), the active tab on multi-tab dashboards, and a cached snapshot of your billing summary so the Settings page renders faster.

3.3 Analytics

We may add a privacy-respecting analytics provider (such as Plausible or PostHog) before commercial launch so we can understand which features are used and where the Service can be improved. When we do, we will list the specific cookies or identifiers here and update the Privacy Policy. We will not use any analytics provider that builds personal advertising profiles.

3.4 Error monitoring

We may add an error monitoring provider (such as Sentry) before commercial launch. When we do, the provider may set a first-party identifier to group related errors. We will list it here.

4. Third-party cookies

Some pages of the Service rely on cookies set by third parties we work with. These are independent operators and their cookies are governed by their own policies.

  • Google sets cookies during the Google sign-in flow and inside the Map widget. See Google's cookie policy.
  • Stripe sets cookies when you reach a Stripe Checkout page or the Stripe Customer Portal. See Stripe's cookie settings.
  • Cloudflare may set a security cookie ("__cf_bm") on guest pages served through Cloudflare to distinguish humans from automated traffic. See Cloudflare's cookie policy.

5. Managing cookies

You can manage cookies through your browser settings. Most browsers let you block all cookies, block third-party cookies only, or clear cookies on exit. Blocking the strictly necessary cookies listed in section 3.1 will prevent you from signing in and using paid features.

We show a cookie consent banner on your first visit that lets you accept all cookies, reject non-essential cookies, or open the preferences dialog to choose category by category. We respect your choice across the Service. You can change your mind at any time by using the button below.

6. Do Not Track

Some browsers send a "Do Not Track" signal. There is no industry consensus on how to interpret it, so we do not currently respond to those signals. We will revisit this if a consistent standard is adopted.

7. Changes to this policy

We may update this Cookie Policy from time to time. If we make material changes we will notify you by email and post the updated policy on this page at least thirty (30) days before the changes take effect. The "Effective date" and "Last updated" dates at the top of this page tell you when the policy was last revised.

8. Contact us

For any question about this Cookie Policy, contact us at:

Invitarium, LLC
Delaware, United States
support@invitarium.io