Cookie Policy
The small number of cookies and similar technologies Mosaikin uses, and why none of them track you across the web.
With our lawyers
This document is with our lawyers for final review. Still to be confirmed: the effective date.
The legal pages are published as one set, so every page carries this notice until the last detail is confirmed. Anything this page quotes that is still outstanding is marked below.
If you need any of it now, email hello@mosaikin.app and we will tell you.
Mosaikin uses a small number of cookies and similar technologies (such as your browser’s local storage, and an offline copy of the pages guests use). We do not use advertising or cross-site tracking cookies.
1. Strictly necessary (no consent required)
| Type | Name | What it does | How long it lasts |
|---|---|---|---|
| Cookies | sb-<project>-auth-token (split into .0, .1 and so on when it is long) and sb-<project>-auth-token-code-verifier (and similar names ending code-verifier); mosaikin_guest_session; mosaikin_staging_gate | The sb- cookies keep a host signed in, and the code-verifier ones check that a sign-in coming back to us, from Google or from a link we emailed, is the one this browser started. mosaikin_guest_session is set by our server when a guest joins an event: it links that device to that one event, so the guest can add photos and see their own. mosaikin_staging_gate lets our team into a test version of the site before launch. | The sb- sign-in cookies: up to 400 days, renewed while you use the site, and removed when you sign out; the code-verifier ones until the sign-in completes. mosaikin_guest_session: 24 hours. mosaikin_staging_gate: 30 days, only on a pre-launch deployment. |
| Local storage (on your device) | mosaikin.guest.name and mosaikin.guest.showName; mosaikin.reminder.<event id>; mosaikin.installPromptDismissed; mosaikin-help-bot-greeted; mosaikin-debug-store | The name you typed when adding photos, so it is filled in next time, and your choice not to show it with your photos (kept only if you untick that box). A reminder to add photos later, if you set one. That you dismissed the suggestion to add Mosaikin to your home screen, so it is not offered again. That you have seen the help assistant’s welcome hint. mosaikin-debug-store is a developer setting that using the site never writes. | Until you clear it. Your name and choice also go if you clear the name; a reminder goes when you dismiss it. |
| Session storage (this tab only) | mosaikin.consent.<event id>; mosaikin.reauth.delete-account; mosaikin.pendingDiscountCode | That you accepted the notice shown before adding photos to this event, so it is not shown again before every batch. Every upload still records your acceptance with us. mosaikin.reauth.delete-account is left only when a host who signs in with Google asks to delete their account and we send them to Google to confirm it is them: it shows that this tab asked, so the return from Google can finish the deletion they asked for and a link alone cannot. mosaikin.pendingDiscountCode is left only when you open our pricing page from a link that carries a discount code: it holds that code, so it is filled in for you when you upgrade your event. | This tab, and never more than 24 hours. mosaikin.reauth.delete-account: removed when you come back from Google, and honoured for 10 minutes at most. mosaikin.pendingDiscountCode: removed once the code is applied to your event, or if it turns out not to be valid, and never outlives the tab. |
| IndexedDB (on your device) | mosaikin-tray; mosaikin-import; mosaikin-guest-photos; mosaikin-own-photos | Photos you have taken but not yet sent, so a reload or a lost signal never loses them. A list of which photos from a large selection have been sent (no photos). The private key that lets you see your own photos after your guest session ends; we never email it. Small copies of your own photos, never anyone else’s, so “Your photos” opens without signal. | Unsent photos and the sending list: 24 hours. The private key, and the copies of your photos that go with it: 30 days, or until you remove the event from your phone. |
| Offline copy (Cache Storage) | mosaikin-shell-<version> and mosaikin-static-<version> | A copy of the guest upload and event pages, and the files they need, so the camera page opens in a venue with no signal. It holds no photos and nothing about you. | Replaced when we release a new version of the offline pages; until then, until you clear it. |
| Security check (Cloudflare Turnstile) | Set by Cloudflare, inside its own frame | Tells people from bots when you send photos, a guestbook message, an RSVP, feedback or a report. | Set by Cloudflare |
These are required for the service to function and are exempt from consent under PECR regulation 6(4).
This list comes from our cookie audit of 14 October 2026, which checked every place our website, its offline pages and our servers store something in your browser. We add a new item to the audit and to this page before we start using it.
2. Analytics and other non-essential cookies
We use no analytics, advertising or cross-site tracking cookies. Two cookieless analytics scripts, Cloudflare Web Analytics and Plausible, count page visits, and each runs only where a deployment of Mosaikin turns it on. Neither sets a cookie or stores anything in your browser, and neither follows you to other sites.
If we ever want to use a cookie or other storage that is not essential, we will list it here and ask for your consent before setting it.
3. Managing cookies
You can clear or block cookies in your browser settings; blocking the strictly necessary ones will stop sign-in and uploads from working.
Clearing your browser’s data for our site also removes any photos still waiting to be sent, so let them finish sending first.
Questions: hello@mosaikin.app. More on how we handle personal data: Privacy Notice.