Cookie Policy
This page explains what Bridewell stores on your device — cookies and similar technologies such as browser storage — why, and how you control it. It is written to meet the Norwegian Electronic Communications Act (ekomloven) § 3-15 and the GDPR, which require that you are told what is stored and why, and that anything beyond what is strictly necessary happens only with your consent.
1. The short version
- Bridewell uses only strictly necessary cookies and storage by default: to keep you signed in, remember your light/dark preference, remember your cookie choice, and let the installed app open quickly.
- There are no advertising or tracking cookies, and no third-party scripts run on the page by default. The one exception is security: our hosting provider, Cloudflare, runs a small bot-protection script served from bridewell.io itself, and sets a security cookie only when it needs to tell a person from a bot. It does not track you across sites.
- When you buy a plan you are taken to our checkout page at pay.bridewell.io — a separate address — where the secure payment form of Paddle, our merchant of record, runs inside a frame. Paddle sets its own cookies inside that frame, needed to complete the payment, under its policy. Nothing from Paddle is loaded or stored on bridewell.io itself, and Paddle's optional analytics is blocked on the checkout page.
- Bridewell currently collects no usage statistics. If that changes, you will be asked first.
2. What is stored on your device
| Name | Set by | Kind | Purpose | Lifetime |
|---|---|---|---|---|
__Secure-better-auth.session_token | Bridewell | Cookie · strictly necessary | Keeps you signed in. HttpOnly, Secure and SameSite, so scripts and other sites cannot read it. | 30 days, extended while you use Bridewell; removed when you sign out |
__Secure-better-auth.session_data | Bridewell | Cookie · strictly necessary | A signed, short-lived copy of your session so most pages load without a database lookup. | 5 minutes |
bridewell.displayMode | Bridewell | Browser storage (localStorage) · strictly necessary | Remembers whether you chose light, dark or system appearance. Only written when you make a choice. | Until you clear site data |
bridewell.consent | Bridewell | Browser storage (localStorage) · strictly necessary | Records your cookie choice and when you made it, so we do not ask again. | Until you clear site data; asked again if this policy's categories change |
| App shell cache | Bridewell | Service worker / Cache Storage · strictly necessary | Lets the installed app open instantly and show its interface while offline. Your wedding data is never cached — it is always fetched live. | Until the app updates, or you uninstall it or clear site data |
| RSVP reply page (/rsvp/…) and shared run sheets (/s/…) | Bridewell | Nothing | The pages someone opens from an RSVP link or a shared run-sheet link set no cookie and stores nothing on the device: no sign-in, no preference, no consent record and no app cache. They show no cookie notice because there is nothing to ask about. | — |
| Bot-protection script (Cloudflare) | Cloudflare (our hosting provider) | Script from our own domain · strictly necessary (security) | A small script Cloudflare adds to every page to detect automated abuse (credential stuffing, scraping, fake sign-ups). It looks at browser signals, stores nothing itself and does not follow you to other sites. | Runs only while the page is open |
__cf_bm | Cloudflare (our hosting provider) | Cookie · strictly necessary (security) | Set by Cloudflare's bot protection to remember that your browser passed its check, so you are not re-checked on every request. | 30 minutes |
cf_clearance | Cloudflare (our hosting provider) | Cookie · strictly necessary (security) | Only set if Cloudflare has to run a visible security challenge, for example during an attack, to remember that you passed it. | As set by Cloudflare for the challenge (typically up to 1 year, or until you clear cookies) |
| Checkout (Paddle) on pay.bridewell.io | Paddle (merchant of record) | Script from cdn.paddle.com and payment frame from buy.paddle.com, on pay.bridewell.io only · strictly necessary (payment) | Loaded only on the checkout page you reach by choosing a plan; it shows Paddle's secure payment form. Paddle sets cookies on its own domain inside that frame to complete the payment and prevent fraud. Nothing is set on bridewell.io, and no analytics or tracking script of Paddle's is allowed to run on the checkout page. | While the checkout page is open; Paddle's own cookies as set by Paddle |
| Usage statistics (Cloudflare Web Analytics) | Cloudflare | No cookie and no storage · optional | Not in use. | — |
3. Consent and how to change your mind
Strictly necessary storage does not require consent (ekomloven § 3-15, second paragraph, and the ePrivacy Directive art. 5(3)); it is what makes the service you asked for work. We still tell you about it in the notice you see on your first visit and on this page.
Anything optional is off by default and is switched on only when you choose it. You can change or withdraw your choice at any time, as easily as you gave it: use the Cookie settings link in the page footer or on your Account page, or the button above. Withdrawing consent stops optional statistics from the next page load; it does not affect data already collected in aggregate, which cannot be traced back to you.
4. Browser controls
You can also block or delete cookies and site data in your browser settings. If you block the strictly necessary cookies, you will not be able to sign in.
5. Contact
Questions about this policy: privacy@bridewell.io. How we handle personal data more generally is described in the Privacy Policy.