Last updated September 20, 2026
1. The short version
Lazo sets five cookies. All five exist to make the product work: to keep you signed in, to remember your language and whether you asked for the dark theme, to remember which wedding a planner is looking at, and to remember that a guest already typed the password for a private wedding page.
There is no advertising cookie, no analytics cookie and no third-party tracker on this site. Nothing here follows you anywhere else, and nothing here is sold.
2. What a cookie is
A small piece of text a site asks your browser to keep and send back on your next visit. It is how a website remembers anything at all between one page and the next — including that you are the person who signed in a moment ago.
3. The five, by name
authjs.session-token — keeps you signed in. Without it, every page would ask for your password again. It is deleted when you sign out, and in production it carries the browser’s __Secure- prefix, which means it is only ever sent over HTTPS. Essential.
lazo_locale — whether you are reading Lazo in English or Spanish. Set when you use the language switch. Functional; about a year.
lazo_theme — whether you asked for the light theme, the dark one, or whatever your device prefers. Functional; about a year.
lazo_client — for a wedding planner with more than one client, which wedding they are currently looking at. Without it, every tab would open on a different wedding. Functional; lasts the session.
lazo_wedding_<id> — set when a guest types the password for a wedding page that has one, so the page does not ask again on every section. It is signed, it is scoped to that one wedding, and it stops working the moment the couple changes the password. Essential; lasts the session.
4. What we do not set
No Google Analytics, no advertising pixel, no social-network tracker, no session recorder, no A/B testing cookie. This is not a promise about the future written to sound good — it is a fact about the code today, and a test fails the build if a new cookie appears without being written down here.
Emails we send contain no tracking pixel. We know that an email was accepted by the receiving server, because the provider that sends it tells us; we do not know whether you opened it.
5. Turning them off
Every browser can refuse cookies or delete the ones it has, usually under Settings → Privacy. Doing that for lazo.wedding signs you out and makes the language, theme and password memory forget themselves. Nothing else breaks.
There is no consent banner on this site, because there is nothing here to consent to beyond the cookies that make it work.
6. Storage that is not a cookie
The offline invitation — the wedding page a guest can open with no signal — keeps a copy of that page in the browser’s own cache, through a service worker. It holds the page and its photos and nothing about the person reading it. Clearing site data removes it.
7. Changes and contact
If Lazo ever sets a cookie that is not on this list, this list changes first and the date at the top changes with it. Questions: hello@lazo.wedding.