Cookie Policy

Version 4 (minor update) · Effective: 2026-10-24

This minor update describes our first-party gallery analytics cookie. It does not require re-acceptance. This policy is informational; it does not gate sign-in.

This Cookie Policy explains the small files and similar technologies the MomentPix platform uses in your browser, and the choices you have. We aim to keep this short — there is not much to describe, because we use very few of these.

A short version

• We use a small set of cookies that the Platform needs to function (signing you in, keeping your gallery session active, holding items in your cart while you check out).
• We also use a first-party analytics cookie to count visits and understand how galleries are used.
• We do not use third-party advertising cookies.
• We do not use cross-site tracking pixels.
• We do not use session-replay or fingerprinting tools.
• We do not run analytics scripts that share your data with advertisers or data brokers.

If you only read one section, that is it. The rest is detail.

What is a cookie

A "cookie" is a small piece of text a website asks your browser to remember. Browsers send the cookie back on subsequent requests so the site can recognize you between page loads — for example, to keep you signed in. Some cookies expire when you close your browser; others persist until they expire on their own or you clear them.

This policy uses "cookie" loosely to also include closely related browser storage mechanisms (such as localStorage and sessionStorage) where MomentPix uses them.

What MomentPix uses

We use cookies for three purposes:

1. To keep you signed in to the Platform.
2. To remember context inside the Platform, such as which gallery access code you have entered or what is in your cart.
3. To count visits and understand how galleries are used, using our own first-party analytics.

We do not use cookies for advertising, cross-site tracking, or fingerprinting.

Authentication cookies

| Cookie | What it does | When it expires | |---|---|---| | mp_auth_consumer | Identifies you as a signed-in consumer; lets you place orders and download photos you have purchased. HttpOnly. | At session end or sign-out (whichever is sooner). | | mp_auth_photographer | Identifies you as a signed-in photographer or platform staff; gives you access to the Studio dashboard. HttpOnly. | At session end or sign-out (whichever is sooner). | | mp_auth_platform | Identifies you as a platform-administration user. HttpOnly. | Short-lived; expires within a few hours of sign-in. |

These cookies are scoped to specific subdomains:

• mp_auth_consumer is scoped to the consumer-facing host (typically app.momentpix.com).
• mp_auth_photographer is scoped to the studio host (typically studio.momentpix.com).
• mp_auth_platform is scoped to the platform-administration host (typically admin.momentpix.com).

That separation is intentional — your photographer credentials are not sent to consumer pages, and vice versa.

Gallery and session context

| Cookie / storage | What it does | When it expires | |---|---|---| | mp_consumer_token | Mirror of mp_auth_consumer used by the in-page application to recognize a signed-in consumer for cart and lightbox. Stored in localStorage. | When you sign out, when the underlying session expires, or when you clear browser data. | | Gallery access cookie | Remembers that you have entered a gallery access code or password so you do not have to re-enter it on every page within the gallery. | Typically a few hours after issue. | | Cart localStorage entries | Holds the items you have placed in your cart while you continue browsing or finish checkout. | Until checkout completes, you clear your cart, or you clear browser data. |

First-party gallery analytics

| Cookie | What it does | When it expires | |---|---|---| | mp_session | Recognizes the same browser to count visits and understand how galleries are used. First-party; never shared or sold; no cross-site tracking. | 30 days after it is set, or sooner if you clear it. Browsing with an existing cookie does not renew its lifetime. |

mp_session is separate from your sign-in session. It is scoped to the host that sets it, with path / and SameSite=Lax. It is readable by page scripts (not HttpOnly), and the application sets the Secure attribute.

Cookies set by our service providers during checkout

When you reach the checkout page and enter payment information, our payment processor (Stripe) loads a small embedded form into the page. Stripe sets its own cookies to operate that form securely (for example, to detect fraud). These cookies are governed by Stripe's own cookie and privacy policies. They appear only on the checkout page itself, not on the rest of the Platform.

We do not load Stripe's payment form on pages other than checkout. If you do not reach checkout, you do not encounter Stripe's cookies on MomentPix.

What we do not use

For clarity, the Platform does not load:

• Third-party advertising cookies (no Google Ads, no Facebook Pixel, no programmatic-ad-network tags).
• Cross-site tracking or "follow-you-around-the-web" pixels.
• Session-replay or screen-recording tools.
• Browser-fingerprinting tools.
• Analytics products that combine your activity on MomentPix with your activity on other websites.

If we ever introduce a tool of this type, we will update this policy and surface the change on your next sign-in.

How to manage cookies

Most browsers let you view, manage, and delete cookies. Methods vary by browser:

• Chrome: Settings → Privacy and security → Cookies and other site data.
• Safari: Settings → Privacy → Manage Website Data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.

You can also use private/incognito browsing to limit cookie persistence.

If you clear or block MomentPix's authentication cookies, you will be signed out and asked to sign in again. If you block cookies entirely on momentpix.com and its subdomains, the Platform may not work — sign-in, gallery access, and checkout all rely on cookies functioning.

Browser privacy signals

We do not sell personal information or share it for cross-context behavioral advertising. Our analytics does not yet treat the Global Privacy Control (GPC) browser signal differently. The planned Customer Intelligence O3 — Ingest enrichment update will honor Sec-GPC: 1 by leaving activity unlinked to your account while still counting it in aggregate totals. Until that update is released, GPC does not prevent account-linked activity from being recorded. You can contact privacy@momentpix.com about your privacy choices.

Changes

If we change how we use cookies, we will update this policy. The version number and effective date at the top reflect the current version. Material changes are reflected in the version bump.

Contact

For questions about this Cookie Policy:

MomentPix, LLC Miami, Florida Email: privacy@momentpix.com