Security & data
The site is built to hold as little as possible and to leak nothing. No account to get a budget, no third-party trackers, and your contact details stay private until a videographer actually accepts your request. Here is the machinery, rather than the promise.
What your browser is told, on every page
This is the policy the server sends with this page. It is also the reason the “no ad network, no third-party analytics” claim is checkable rather than a pledge: the browser refuses anything not listed, whether or not we meant it.
Referrer-Policy: no-referrer X-Content-Type-Options: nosniff X-Frame-Options: DENY Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://i.vimeocdn.com; font-src 'self'; frame-src https://player.vimeo.com; connect-src 'self'; form-action 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'
default-src 'self'— scripts, styles and fonts load from this domain or not at all. There is no ad tech and no widget host on any page, and nothing can be added without changing this line.- Vimeo is the one exception, and it is named explicitly:
frame-srcfor players,img-srcfor reel thumbnails. Vimeo therefore sees a request when a page shows a film. Nothing else about your visit leaves this domain. Referrer-Policy: no-referrer— a videographer's inbox link is the key to their leads, so no link ever hands it to another site through theRefererheader.frame-ancestors 'none'— nobody can iframe this site to trick you into clicking it. The one framable path is the videographer embed widget, which is meant to be framed.
What a client IP is allowed to do
Fixed per-minute windows on the write paths, refused with a 429 before they reach the engine or anyone's inbox. Bodies are capped at 32 KB and free-text fields are length-limited server-side.
| Endpoint | Per IP | What it does |
|---|---|---|
POST /api/quote | 90 / min | Describe a shoot, get a budget estimate |
POST /api/estimate | 120 / min | Re-price an already-structured request |
POST /api/order | 10 / min | Create a routable request |
POST /api/lead | 10 / min | Ask to be matched |
POST /api/videographers | 5 / min | List as a videographer |
POST /api/auth/request | 5 / min | Request a sign-in link |
What a videographer sees before they accept
Your name, email and phone are withheld from the lead entirely. They unlock for exactly one videographer — the first to accept — and for nobody else.
The honest edge case is your own description, which does go to the matched videographers so they can decide whether to take the job. Anything that looks like a contact detail is rewritten before it reaches them:
- An email address arrives as
[email hidden — accept to reveal] - A phone number arrives as
[phone hidden — accept to reveal]
Redaction is pattern-based, so put contact details in the contact field rather than the description — if you type your venue or your surname into that box, the videographers who were matched will read it.
One cookie, and only if you sign in
Clients never get one. A videographer signing in gets exactly this:
Set-Cookie: vgr_session=…; HttpOnly; SameSite=Lax; Path=/; Max-Age=2592000
HttpOnly means JavaScript cannot read it, SameSite=Lax means another site cannot make your browser send it, and signing out clears it. There is no second cookie, no advertising cookie, and no cross-site tracking. Counts of page views, budget estimates and leads are kept to the hour, with no referrer and no personal profile — see Privacy.
Report a concern
If you believe you’ve found a security or privacy issue, write to [email protected]. We’ll confirm we got it. Please don’t include passwords or sensitive personal data in the message, and please give us a reasonable window to fix it before publishing.