Cookie policy.

• Host session. Keeps you logged in to your dashboard. Set by our sign-in provider, Supabase. Lasts while you are logged in.
• Guest session. When you join an event, a signed cookie remembers that it is you, so you can come back to add photos without logging in again. Lasts 90 days. It holds a random guest ID, nothing about you.
• Bot protection. Cloudflare Turnstile sets a short-lived cookie on forms to tell people from bots, so we can leave off the puzzles.
• Payment. Stripe sets its own cookies on the checkout page for fraud prevention. Their policy is at stripe.com/cookies-policy.
• Partner link. If you arrive through a partner's link (hazel.camera/with/their-code), a cookie remembers their code for 30 days so the 10% off is applied at checkout without typing it. It holds the code, nothing about you.
• Leaflet link. If you scan the QR code on one of our printed leaflets (hazel.camera/hello/…), a cookie remembers the leaflet's code for 30 days so the 10% off is applied at checkout without typing it. It holds the code, nothing about you.

All of these are strictly necessary for the service to work, which is why the law does not require your consent for them and we do not ask.

On the public site and the host dashboard we use Google Analytics, loaded through Google Tag Manager, to see how many people visit, where they came from and which pages help. It sets cookies (_ga and _ga_…, up to two years) that give your browser a random ID so repeat visits count once. Google's policy is at policies.google.com/technologies/cookies.

In the UK, the EU and EEA, Switzerland and Quebec, these only run if you choose Accept on the banner. Choose No thanks and no analytics cookies are set and nothing is measured; the site works exactly the same. Your answer is kept in your browser so we do not ask again.

Everywhere else, where the law does not ask for a banner, they run without one. You can still turn them off: change your cookie choice (also under Cookies at the foot of every page) and choose No thanks.

Pages for guests (joining an event, adding photos, viewing an Album) never load Google Analytics, so guests see no banner.

We advertise hazel on Google, Facebook, Instagram and Pinterest. To know whether an ad worked, and to show our ads again to people who have already visited, the Google Ads tag, the Meta pixel and the Pinterest tag note visits and when someone signs up, makes an event or pays for one. They set cookies (Google's _gcl_au, Meta's _fbp and Pinterest's _pin_unauth and _epik, up to a year) with a random ID, and send Google, Meta or Pinterest that the action happened, with the amount paid. We never send your name or email. Their policies are at policies.google.com/technologies/ads, facebook.com/privacy/policies/cookies and policy.pinterest.com/cookies.

They follow the same choice as analytics: in the UK, the EU and EEA, Switzerland and Quebec they only run if you choose Accept, and they never run on the pages for guests.

Your browser remembers a couple of small conveniences: that you have seen a host's welcome message, and that you have seen the "swipe up" hint in a slideshow, so we do not show them twice. These never leave your device.

You can delete cookies in your browser settings at any time. If you delete the guest cookie you can log back in with the email you joined with. If you block cookies entirely, sign-in and joining will not work.

Questions: the contact form. Run by Digby Studios Ltd.