Your message is on its way — the creative will get back to you directly.
Show external media?
Players from YouTube, Spotify, Instagram & co. load directly. Their providers receive your IP address and may set cookies. You can change this anytime.
Last updated: 1 November 2026
Cookies are small text files stored on your device. This portfolio uses necessary cookies for sessions, security and your choices. External media providers may use their own cookies or similar technologies once one of their players loads — after you tap it, or straight away if you allow external media.
All of these are essential for the site to function and cannot be disabled.
pending_sessionidKeeps you logged in between page loads and remembers password unlocks on protected portfolios.
csrftokenProtects forms against cross-site request forgery attacks.
tp_cookie_consentRemembers your cookie choices, including whether external media may load without a tap, so we don't ask again.
Our own servers record portfolio views, link clicks and media opens without analytics cookies. These records include the portfolio/link, time, referring website, device/browser category and approximate country, region and city where available. For daily visitor counts, we derive a daily-changing pseudonymous identifier from your IP address and browser information. The raw IP address is not stored in these analytics records.
Portfolio owners can see aggregated visitor statistics in Portfolio Studio; individual visitors are never identified.
Campaign-link attribution is a separate optional choice, called “Campaign links”; “Accept All” in the cookie notice includes it. If it is on, the existing server-side session holds the campaign code and information identifying that decision. No separate campaign cookie is added. We use the existing session cookie to connect the permitted visit with a later signup only while that decision remains valid. A visit made without this permission, or one whose permission was withdrawn or has expired, is not attributed after a later opt-in. Without this permission, links still work and visits may still be counted without associating them with your new account. Turn off “Campaign links” in cookie preferences or in the website’s Settings → Data & ads. Turning off personalised partner advertising alone does not change this separate choice. This choice is also separate from the membership-time invitation programme and from PostHog analytics.
The cookie notice on this portfolio only offers External media. Change Campaign links in the main site’s cookie settings.
The membership-time invitation programme does not set the former tp_ref cookie; the updated website deletes it when received. A code travels in invitation links and signup forms or app requests. In the app it is kept in process memory and is cleared on removal, sign-in or process exit; it is not saved in a persistent referral store. There is no automatic app-store recovery of an invitation. You can type a code or open a direct invitation link.
If you select provider sign-in after “Use invitation”, the existing browser session cookie leads to the sign-in’s own security state, which carries a random reference to that attempt; the selected code, notice version and provider are held in our server cache for at most 30 minutes, usable only by that attempt, and removed when it finishes or expires. The session cookie normally lasts seven days, which does not make the referral hold valid for seven days.
The account attribution and qualification checks rely on legitimate interest under Article 6(1)(f) GDPR, separately from advertising or analytics consent. Device storage and access are assessed separately under § 25 TDDDG. Transient operations strictly necessary to carry an invitation you expressly request through signup can fall under § 25(2)(2); using an existing session cookie does not exempt unrelated tracking. Ignore or remove the invitation (×) to sign up without attribution; only “Use invitation” links the accounts. Afterwards use Settings → Privacy → “Stop counting me”, or contact support. Privacy Policy Section 8 explains the checks, objection, recipients and retention.
YouTube, Vimeo, Spotify, SoundCloud, TikTok and Instagram content first appears as a preview served by us, so your browser does not contact the provider when the page loads. For YouTube, Vimeo, Spotify, SoundCloud and TikTok, our server fetches the title and cover image from the provider's public interface and stores them, without passing on your IP address, cookies or browser data. Instagram is never contacted by our server; Instagram and TikTok appear as a tile with the account name or a cover. The line below each preview names the provider and links to its privacy policy, and you can open the content on the provider's site instead.
External media is an optional category and is off by default. While it is off, a provider's player loads only when you tap that preview; for Instagram and TikTok, a tap loads their own embed page. If you choose Show all in the cookie notice or turn on the switch below, all players load as soon as a page opens. When a player loads, the provider receives your IP address, browser information and the address of this website, and may set its own cookies or similar technologies.
Load YouTube, Vimeo, Spotify, SoundCloud, TikTok and Instagram players without a tap.
A tap and this switch are the same choice: tapping a player turns external media on, so later players of every provider load directly. The choice is kept for 180 days in this browser's local storage (tp_external_media_v1, not a cookie), in the tp_cookie_consent cookie and, if you are signed in, on your account. To withdraw it, turn the switch off or select Turn off external media at any loaded player; all players then unload. Leaving a scene or closing a detail view also unloads its players. This does not erase data already received or cookies already set by a provider; you can manage those in your browser. Deleting the session cookie may log you out or require re-entering a portfolio password.
For questions about our use of cookies, contact us at service@thepending.app.