Cookie Policy

1. What cookies and browser storage are

A cookie is a small text file a website asks your browser to keep and hand back with your next request. Sites use cookies to remember what a page cannot remember on its own: that you are signed in, which language you chose, that you already entered a gallery password.

Your browser also has two similar stores. Local storage stays until you clear it. Session storage is emptied the moment you close the tab. Unlike cookies, neither is sent to a server automatically. The page in front of you reads and writes them itself.

We use all three, and all three are listed below.

2. What we use them for

Four things, and nothing else. Keeping you signed in and letting you through a gallery's password gate. Remembering a choice you made yourself: language, theme, grid or masonry. Remembering which photographer invited you, when you arrive through their invite link, until you create your account. Measuring how our own public site is used, on that site only.

Find Me does not use cookies. No cookie of ours holds a selfie, a face template, or anything derived from one, and we never use cookies to work out who appears in a photograph.

3. Strictly necessary cookies

These make the site work. Without them you cannot pass a password gate, cannot stay signed in, and every visit starts from the default language and theme.

• mz_gid: a signed random id for your browser, set when you unlock a password-protected gallery or photographer site. It keeps your usage limits separate from everyone else's when a whole venue shares one internet connection. It is a random identifier, not a name. It tells us nothing about who you are, but because it is unique to your browser for thirty days the Law treats it as personal data, and it is covered by the rights described in the Privacy Policy. Thirty days.
• mz_unlock_… (one per gallery): proof that you entered that gallery's password, so you are not asked again on every page. Thirty days.
• mz_unlock_portfolio_… (one per photographer site): the same, for a photographer's site password. Thirty days.
• mz_ref: the referral code from a photographer's invite link, set on mosawer.app only, when you follow that link. It remembers which photographer invited you, so that if you subscribe you both get the credit the invite offers. It holds nothing about you. If you follow more than one invite link, the last one counts. It is read once, when you create your account, and removed then. If your browser blocks it, you can still enter the referral code when you choose a plan. Thirty days.
• NEXT_LOCALE: the language you chose, Arabic or English. One year.
• theme: light, dark, or follow my device. One year.
• theme-resolved: when you choose "follow my device", this records what your device resolved to, so the page arrives in the right theme instead of flashing the wrong one first. One year.

The two unlock cookies and mz_ref cannot be read by the pages themselves. They travel only to us, over an encrypted connection.

4. Sign-in cookies

These exist only if you have an account and sign in. A guest browsing a gallery never receives any of them.

• The session cookie: keeps you signed in. Seven days.
• Two short caches, one for the session and one for the account, so every page does not have to re-check your session from scratch. Five minutes each.
• A "do not remember me" marker: set when you sign in without asking to be remembered. Disappears when you close the browser.
• The two-step verification cookie: holds your place between your password and your code. Ten minutes.
• The last sign-in method: the word "email" or "google", and nothing else, so the sign-in page can point at the one you used last. Thirty days. This one is a convenience rather than a necessity, and blocking it costs you nothing.

All of them except the last are unreadable by the pages themselves and are sent only to us, over an encrypted connection.

5. Measurement, and the only cookie we do not set ourselves

We measure how our own public site is used, which pages people open, and which of them lead to signing up. That measurement runs on mosawer.app only. It is not on a photographer's subdomain, not on a custom domain, and not inside a gallery. A guest looking at their event photos is not measured by it at all.

• ph_…_posthog: holds a random id for your browser and a few settings. One year.

We set it only if you accept it in the banner shown on your first visit. Until you answer, and if you decline, nothing of it is stored in your browser. Your visit may still be counted, from a code the provider works out on its own servers from your connection and replaces every day, which stores nothing on your device and cannot link your visits from one day to the next.

It is a first-party cookie, stored under our own address, but it is written by the product-analytics service we use and its contents reach that provider. We disclose that provider by its role in our Privacy Policy, and we will send you its name and the country it processes in if you write to [email protected]. It is the only cookie on Mosawer written by anyone other than us, and the requests carrying it go through our own domain rather than a third-party one.

Three limits are worth more than the cookie itself. If you are not signed in, no profile is created for you. Events are counted, not attributed to a person. If you are a signed-in photographer, you are identified by your internal account number only: not your name, not your email address. And page addresses are cut at the first question mark or hash before they are sent, so gallery links and access tokens never reach it.

Our error-monitoring tool sets no cookies and stores nothing in your browser.

6. Browser storage that is not a cookie

Local storage stays on your device until you clear it:

• mosawer-findme:…: the photos Find Me matched to you in a gallery, so returning lands you back on them. It holds photo identifiers and short-lived signed links. It holds no selfie and no face template, and the links stop working after twelve hours.
• mosawer-form-done:…: that this browser already completed a gallery's form, so you are not asked twice.
• mosawer-guest-gallery-view, mosawer-gallery-view, mosawer-showcase-view, mosawer-community-view. Grid or masonry, on each of the four screens that offers the choice.
• mosawer-cart:…: what you put in the basket in a gallery that sells prints.
• mosawer:liked: photos you liked while exploring, up to two hundred. Kept on your device on purpose: nothing about it ever reaches us.
• __mosawer_storage_probe__: written and deleted in the same instant, to find out whether your browser is blocking storage at all.
• mosawer-analytics-consent: your answer to the cookie banner, so we do not ask again. Until you change it in Cookie settings or clear your browser data.
• ph_…_posthog: the measurement entry described above, only if you accept it.

Session storage is emptied when you close the tab:

• mosawer-album-unlock:…: that this tab has already passed a password gate. The real credential is the cookie; this only saves the tab from asking again.
• mosawer-gallery-scroll:…: where you were in a gallery, so going back returns you to the same place.
• ph_…_window_id and ph_…_primary_window_exists: measurement, on mosawer.app only, and only if you accept it.

Apart from the measurement entries, none of this is uploaded to us. It is written by the page in front of you and read by the same page. The only thing that ever travels back is a signed link your browser presents to fetch a photo you have already matched. Clearing your browser data deletes all of it, and we keep no copy to restore.

One more thing that is not storage: pages open in several tabs tell each other when you sign in or out. That signal passes between tabs inside your browser and is not saved anywhere.

7. What we do not use

We set no advertising cookies. We run no ad network, no retargeting pixel, and no social-network pixel. We do not sell anything collected by cookies, and we do not hand it to advertisers. We do not track you across other websites, and we hold nothing that would let anyone else do it.

The list on this page is complete. It is written from what the product actually sets, not from a template, and if you find something on your device under our name that is not listed here, tell us and we will explain it or remove it.

8. A photographer's own address is still us

A photographer can publish their galleries on a mosawer.app address or on a domain they own. Either way the site is ours: the same software, the same servers, and the cookies and storage described on this page.

They are set under whichever address you are visiting. So unlocking one photographer's gallery does not unlock another's, and clearing site data for one address does not touch another. The measurement cookie and mz_ref are not set on those addresses at all. They belong to mosawer.app only.

9. How to control them

Every browser lets you see the cookies a site has set, delete them, block new ones, and clear site storage. The controls sit under Privacy or Site settings, and mobile browsers have the same. Deleting is immediate and needs nothing from us.

Know what breaks. Block cookies and you cannot stay signed in, cannot get past a gallery password, and your language and theme reset on every visit. There is no way to keep those features without the cookies that carry them. You can decline the measurement cookie in the banner, or block it on its own in your browser or with a content blocker, and nothing about the service changes.

The first time you visit mosawer.app, a small banner asks whether we may set the measurement cookie, with Decline beside Accept at the same size. You can change your answer at any time from Cookie settings at the bottom of the page, and taking your consent back removes the cookie at once. Your answer is kept in your browser so we do not ask on every visit. No other cookie we set calls for your consent: each is either needed for the part of the service you asked for, or a record of a choice you made yourself.

The necessary cookies rest on delivering the service you asked for. The measurement cookie rests on your consent, which you give or refuse in the banner and can withdraw at any time. Counting visits without a cookie rests on our legitimate interest in understanding how our own site is used, an interest we have weighed against your privacy, and which never extends to sensitive data. We have carried out and documented that balancing assessment as the Law requires, and we will provide it to the competent authority on request. Your rights over your personal data, and how to exercise them, are set out in the Privacy Policy.

10. Changes to this page

We update this page whenever we add, remove, or change what we set. Because the list is written from what the product actually does, a change here means a change in the product.

Last updated 1 October 2026.

11. Contact us

For any question about this page (including what a particular cookie or storage entry contains) write to [email protected] and we will answer.

Mosawer LLC 30 N Gould St, Ste N, Sheridan, WY 82801, United States [email protected]