Last updated: 13 October 2026 Effective date: 10 October 2026
1. About This Policy
This Cookie Policy explains how WedBuild Pty Ltd ("WedBuild," "we," "us," "our") uses cookies, local storage, and similar tracking technologies when you use our wedding planning platform at https://app.wedbuild.com, our website at https://wedbuild.com, and related services (the "Service").
This policy should be read alongside our Privacy Policy, which explains how we collect, use, and protect your personal information.
2. What Are Cookies and Similar Technologies?
Cookies are small text files stored on your device by your web browser when you visit a website. They allow the website to remember your actions and preferences over time.
Local storage is a browser feature that allows websites to store data on your device. Unlike cookies, local storage data is not automatically sent to the server with every request, but it persists until explicitly cleared.
Tracking pixels (also called web beacons) are tiny transparent images embedded in emails or web pages that allow us to track whether content has been viewed or a link has been clicked.
We use a combination of these technologies as described below.
3. Categories of Technologies We Use
3.1 Strictly Necessary (Always Active)
These technologies are essential for the Service to function. They cannot be disabled without breaking core functionality. No consent is required for these under Australian privacy law, the GDPR, or ePrivacy regulations.
| Technology | Provider | Purpose | Storage Type | Duration |
|---|---|---|---|---|
| Sign-in cookies | WedBuild (Supabase authentication) | Keeping you signed in to the app, managing your session, and refreshing authentication securely | httpOnly cookies (wb_access, wb_refresh), plus wb_has_session, which holds no token and only tells the page you are signed in | wb_access until the session token expires; wb_refresh and wb_has_session up to 30 days, or until you sign out |
| Security cookie | WedBuild | Protecting forms and requests in the app and on published wedding websites against cross-site request forgery | Cookie (__csrf) | 24 hours |
| Cookie consent record | WedBuild | Remembering your cookie preferences so we don't ask you again on every visit | On wedbuild.com: localStorage (wedbuild_consent_v2) + first-party cookie (wedbuild_consent). In the app: localStorage (cookie_consent), and for signed-in accounts a record of your choice saved with your account | Up to 1 year on wedbuild.com; in the app until you clear browser data or update your preferences |
| Consent region | WedBuild | Remembering whether the law where you are requires opt-in consent, so wedbuild.com shows the right cookie choices | Cookie (wb_region_optin) | 30 days |
| Password gate cookies | WedBuild | Remembering that you've entered the correct password for a password-protected wedding website or shared run sheet, so you don't have to re-enter it on each page load | httpOnly cookies (wb_auth_…, wb_rs_…), path-scoped | 24 hours |
3.2 Analytics (Region-Based Consent)
These technologies help us understand how users interact with the Service so we can improve it. They are region-aware: in the EU/EEA and UK (and, in the app, Switzerland) they activate only if you opt in via our cookie consent banner; elsewhere (such as Australia and the US) they run by default until you opt out. In the app, visitors outside those regions are not shown a banner (see Section 4).
Signed-in WedBuild accounts. When you use the WedBuild app (app.wedbuild.com) while signed in to your account, recording how you use the app is part of the Service (see section 12 of our Terms of Service and section 7.3 of our Privacy Policy). Outside the EU/EEA, the UK and Switzerland, we record it even if you have chosen Reject All or turned analytics off. Your choice still decides how: PostHog then stores no cookies or local storage on your device, never records your screen, and shows you no surveys or chat widget, but the pages you visit and the features you use in the app are recorded against your account. In the EU/EEA, the UK and Switzerland, app analytics runs only if you opt in. Visitors who are not signed in, including your wedding guests, are recorded only if their cookie choice allows it; outside the EU/EEA, the UK and Switzerland that is the default, including on the app's RSVP and Find My Seat pages.
| Technology | Provider | Purpose | Storage Type | Duration |
|---|---|---|---|---|
| Product analytics | PostHog | Tracking page views, feature usage, and session data to understand how users navigate and use the app | localStorage + cookie (ph_*); none for a signed-in account that has declined analytics | Up to 1 year |
| Session recording | PostHog | Recording user sessions in production to identify usability issues. What you type into fields is masked; other text on the screen, which can include names, may be captured | localStorage | Session |
| First-visit attribution | WedBuild | Recording how you first arrived (landing page, referring site, campaign tags and ad click identifiers) so it can be stored with your account if you sign up | Cookie (wb_ft, shared across wedbuild.com and the app) + localStorage in the app (wedbuild_first_touch) | 90 days (cookie); until cleared (localStorage) |
| Web analytics | Google Analytics 4 | Aggregate site traffic and page/feature usage | Cookies (_ga, _ga_*) | Up to 2 years |
| Performance & traffic | Vercel Analytics & Speed Insights | Privacy-friendly, cookieless visit and performance metrics | None (no cookies) | Not applicable |
What PostHog collects when enabled:
- Your account ID and email address, when you are signed in to the app, so we can support you and understand how accounts use the Service
- Pages visited and features used
- Click and interaction events, including the text of what was clicked
- Session duration and frequency
- Device type, browser, and operating system
- Screen resolution
- Session recordings (what you type into fields is masked; other text on the screen may be captured)
What PostHog does NOT collect:
- Passwords or payment details
PostHog data is processed in accordance with the PostHog Privacy Policy. PostHog is hosted in the United States.
Counts and events that use no cookies. Our marketing site's servers count page views and QR code scans without setting cookies or storing anything on your device: each count is sent to PostHog with an identifier made from a salted hash of your IP address and browser, which changes every day. Separately, the app's servers record key account events (such as signing up and purchases) in PostHog against your account, as described in section 7.3 of our Privacy Policy. Neither depends on your cookie choice, because neither stores anything on your device.
3.3 Error Monitoring (WedBuild App, Always Active)
These technologies help us detect and fix bugs and performance issues in the WedBuild app (app.wedbuild.com). They are part of the Service (see our Terms of Service) and run whatever your cookie choice; the cookie banner controls only the Analytics and Marketing categories.
| Technology | Provider | Purpose | Storage Type | Duration |
|---|---|---|---|---|
| Error tracking | Sentry | Capturing error reports, stack traces, and performance data when something goes wrong | Cookie (sentry-*) | Session |
| Performance monitoring | Sentry | Measuring page load times and API response times to identify performance bottlenecks | Cookie | Session |
| Session replay | Sentry | Replaying a sample of app sessions (about one in ten, plus sessions in which an error occurs) to see what led to a fault. All text is masked and all images and media are blocked. Not recorded on guest-facing pages | sessionStorage | Session |
What Sentry collects:
- Your account ID and email address, when you are signed in, so we can identify and help accounts affected by a fault
- Error messages and stack traces
- Browser type and version
- Operating system
- Page URL where the error occurred
- Performance timing data
- Masked session replays (sampled, as described above)
What Sentry does NOT collect:
- Passwords or payment details
- Unmasked text or media from session replays
Sentry data is processed in accordance with the Sentry Privacy Policy. Sentry is hosted in the United States.
3.4 Email Tracking
When you send announcements or email campaigns to your wedding guests through WedBuild, we embed tracking technologies in those emails on your behalf:
| Technology | Provider | Purpose | Storage Type |
|---|---|---|---|
| Open tracking pixel | WedBuild and Resend | Detecting whether a recipient opened the email | Pixel (not stored on device) |
| Click tracking links | WedBuild and Resend | Detecting whether a recipient clicked a link in the email | URL redirect (not stored on device) |
This tracking applies only to emails you send to your guests, not to emails we send to you. Open and click data is displayed in your WedBuild announcement analytics dashboard.
We send these emails through our email delivery provider, Resend, which also reports delivery, open and click events to us. Resend data is processed in accordance with the Resend Privacy Policy. Resend is located in the United States.
3.5 Third-Party Functional Resources
The Service loads resources from third-party providers for functional purposes. These providers may set their own cookies according to their own policies:
| Resource | Provider | Purpose | Notes |
|---|---|---|---|
| Web fonts | Google Fonts | Loading typefaces used in the app and published wedding websites | Google may collect anonymised usage data. See Google Privacy Policy. |
| Maps | Google Maps | Displaying venue locations on wedding websites, and suggesting addresses and places as you type in the app | Only loaded on pages with map or address features. See Google Privacy Policy. |
| Music embeds | Spotify, Apple Music | Playing a playlist the couple has embedded in their wedding website | Only loaded on websites where the couple has added one. |
3.6 Advertising & Marketing (Region-Based Consent)
These technologies measure the performance of our advertising and let us show you relevant ads on third-party platforms. They are region-aware: in the EU/EEA and UK (and, in the app, Switzerland) they activate only if you opt in to Marketing via our cookie consent banner; elsewhere they run by default until you opt out (see below).
| Technology | Provider | Purpose | Storage Type | Duration |
|---|---|---|---|---|
| Meta Pixel (wedbuild.com only) | Meta Platforms (Facebook/Instagram) | Measuring ad conversions, building audiences, and optimising ad delivery | Cookies (_fbp, _fbc) + requests to facebook.com | Up to 3 months |
What the Meta Pixel collects when enabled:
- Pages visited on our marketing site, and standard events (e.g. PageView, Lead, InitiateCheckout)
- Device, browser, and referring URL
- Meta cookie identifiers (e.g.
_fbp) and, if present, the Meta click ID (fbc)
The Meta Pixel runs on our marketing site (wedbuild.com) only. The WedBuild app (app.wedbuild.com) does not load it and sets no Meta cookies, and neither do the pages your guests use (RSVP forms, Find My Seat, published wedding websites). Where the law requires prior consent (including in the EU/EEA and the UK), it loads only after you opt in to Marketing. Elsewhere (such as Australia and the US) it runs by default. You can opt out at any time by choosing Reject all or turning off Marketing in the cookie banner, after which it stops sending data to Meta.
When you sign up or make a purchase in the app, our servers may send that event directly to Meta (Meta's Conversions API) with a hashed copy of your email address, your account ID, and your IP address and browser details. This uses no cookies in the app, and we do it only when your saved cookie choice in the app allows Marketing. Data is processed by Meta in accordance with the Meta Privacy Policy. Meta is located in the United States.
3.7 Functional
These technologies are not strictly necessary but make the Service more convenient. They store no analytics or advertising data.
| Technology | Provider | Purpose | Storage Type | Duration |
|---|---|---|---|---|
| RSVP guest cookie | WedBuild | Remembering a guest after they RSVP (their name and a reference to their guest record for that wedding) so they can use Find My Seat without re-entering their name | Cookie (wb_rsvp_guest) | 180 days |
| Display currency | WedBuild | Showing prices on wedbuild.com in your local currency, or the currency you pick | Cookie (wb_currency_geo) + localStorage | 30 days (cookie); until cleared (localStorage) |
| Signed-in browser | WedBuild | Remembers that this browser has signed in to WedBuild, so wedbuild.com can show a Dashboard button instead of Try Pro free. Holds no personal information | Cookie (wb_account), set by app.wedbuild.com for wedbuild.com | 1 year after you last use the app, or until you sign out |
| Form drafts | WedBuild | Keeping what you have typed in some forms (such as a domain owner's details during checkout, or an AI chat in progress) if the page reloads | sessionStorage | Until you close the tab |
4. How We Obtain Consent
When you first visit wedbuild.com, a cookie consent banner is displayed at the bottom of the screen. In the WedBuild app, the banner is shown to visitors in the EU/EEA, the UK and Switzerland, and wherever we cannot tell where you are. You can:
- Accept All: enables the analytics and marketing technologies.
- Reject All: only strictly necessary technologies remain active (this also opts you out of the Meta Pixel on wedbuild.com and of the sign-up and purchase events we send to Meta from the app), apart from error monitoring in the app and, outside the EU/EEA, UK and Switzerland, app analytics for signed-in accounts (sections 3.2 and 3.3).
- Manage Preferences: choose individually which categories to enable or disable (analytics and/or marketing).
Analytics (PostHog, Google Analytics, Vercel) and Marketing (the Meta Pixel on wedbuild.com, and our server-side sign-up and purchase events) are region-aware: in places that require prior consent (the EU/EEA and UK, and in the app also Switzerland) they load only after you opt in; elsewhere (such as Australia and the US) they run by default and stop as soon as you opt out, by choosing Reject All or turning off the relevant category in Manage Preferences, except app analytics for signed-in accounts, which continues without cookies, local storage or screen recording (section 3.2). Strictly-necessary technologies are always active. On wedbuild.com we also honour the Global Privacy Control browser signal as an opt-out of advertising/marketing.
Outside the EU/EEA, the UK and Switzerland, the app does not show a banner: unless you have already made a choice, it applies the default for your region, which turns analytics and marketing on. If you chose Reject All on wedbuild.com, that choice is carried into the app when you follow a link from wedbuild.com to the app. You can also contact privacy@wedbuild.com to opt out.
On wedbuild.com your preference is stored in your browser (local storage and a durable first-party cookie) and remembered for future visits. In the app it is stored in local storage and, if you are signed in, saved with your account. You can change or withdraw it at any time (see Section 5).
5. Managing Your Preferences
5.1 Via WedBuild
You can change or withdraw your choices at any time using the Your Privacy Choices link in our website footer. It re-opens the consent banner pre-filled with your current settings, so withdrawing consent is as easy as giving it. Saving your updated choice takes effect immediately (e.g. turning off Marketing stops the Meta Pixel). This link is on wedbuild.com; for the app, see Section 4.
5.2 Via Your Browser
Most browsers allow you to control cookies through their settings. Common options include:
- Block all cookies: may prevent the Service from functioning correctly.
- Block third-party cookies: may affect analytics and error monitoring functionality.
- Delete existing cookies: removes stored cookies but they may be recreated on your next visit (subject to your consent preferences).
For browser-specific instructions:
5.3 Do Not Track & Global Privacy Control
Some browsers offer a "Do Not Track" (DNT) signal. Because there is no industry-standard interpretation of DNT, we do not currently respond to DNT signals. We do, however, honour the Global Privacy Control (GPC) signal on wedbuild.com: where your browser sends it, we treat it as an opt-out of advertising/marketing (the Meta Pixel). Analytics and marketing technologies otherwise follow the regional rules in Sections 3.2 and 3.6 (opt-in in the EU/EEA and UK, opt-out with notice elsewhere), and you can change your choice at any time via the Your Privacy Choices link (Section 5.1).
6. Cookies on Published Wedding Websites
Published wedding websites (at app.wedbuild.com/public/w/… or on a couple's own domain) use a minimal set of technologies:
- Security cookie (
__csrf, strictly necessary): protects the website's forms. It expires after 24 hours. - Password gate cookie (strictly necessary): if the couple has enabled password protection, a cookie is set after you enter the correct password so you don't have to re-enter it during your visit. This cookie expires after 24 hours.
- Google Fonts: typefaces may be loaded from Google's servers.
- Google Maps: loaded if the couple has included a map on their website.
- Spotify or Apple Music: loaded if the couple has embedded a playlist. These services may set their own cookies.
Published wedding websites do not load PostHog analytics, Sentry error monitoring or the Meta Pixel, and set no analytics cookies. To show the couple how many people visit, WedBuild records each visit with the browser type, referring page, device type and a visitor identifier made from a keyed hash of the visitor's IP address and browser (the IP address itself is not stored with the visit). These details are anonymised after 24 months.
The RSVP, Find My Seat and announcement pages that guests open from a wedding website or an invitation are part of the WedBuild app, and follow the app's rules in Sections 3 and 4.
7. Data Transfers
Some of the technologies described in this policy involve transferring data to providers located in the United States (PostHog, Sentry, Resend, Google, Meta). For more information about international data transfers and the safeguards we apply, please see Section 5 of our Privacy Policy.
8. Changes to This Cookie Policy
We may update this Cookie Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. If we introduce new categories of cookies or significantly change how we use existing ones, we will reset your consent preferences so you can make a fresh choice.
9. Contact Us
If you have questions about this Cookie Policy or our use of cookies and similar technologies, please contact us:
Email: privacy@wedbuild.com Website: https://wedbuild.com
WedBuild Pty Ltd Australia
You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) (phone 1300 363 992).