Cookie Policy
Last updated: 23 July 2026
Popup Pal, United Kingdom uses a deliberately small set of cookies. We do not use third-party advertising cookies, and we do not build cross-site tracking profiles. Because everything we set is either strictly necessary or a simple preference you chose, there is no cookie banner standing between your buyers and their tickets.
Cookies we set
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
| authjs.session-token | Keeps organisers, team members and traders signed in. In production the name carries a __Secure- prefix. | Strictly necessary | Session / up to 30 days |
| authjs.csrf-token | Protects signed-in actions against cross-site request forgery. | Strictly necessary | Session |
| authjs.callback-url | Remembers which page to return you to after signing in. | Strictly necessary | Session |
| locale | Remembers your chosen language (English, Español, Français, Deutsch). Set when you change language. | Preference | 1 year |
While you sign in with Google or Apple, a few short-lived cookies (PKCE, state and nonce values) are set to keep that sign-in secure. They are strictly necessary and are deleted as soon as sign-in completes.
Checkout happens on Stripe’s own hosted payment pages (on stripe.com), where Stripe (our payment processor) sets its own cookies for fraud prevention and payment security. These are strictly necessary for taking payment and are governed by Stripe’s own cookie and privacy policies.
Local storage
A few things are kept in your browser’s local storage and session storage rather than in cookies. UK rules on storage access (PECR) treat these the same way as cookies, which is why we list them here.
theme(local storage) — remembers your light/dark mode choice. It has no expiry and stays until you clear your browser data.pp_sid(session storage) — a random analytics session identifier, scoped to the browser tab and gone when you close it.ppref:…(session storage) — ensures a referral link visit is only counted once per tab.
What we don’t do
- No advertising or retargeting cookies.
- No selling or sharing of cookie data with data brokers.
- No tracking of you across other sites, and our analytics never stores your IP address.
Our own analytics keeps an individual record for each page view: the page path, the referring site’s domain, coarse location taken from hosting headers, device and browser type, language, and any campaign (UTM) tags. Each record is keyed by a pseudonymous visitor identifier that changes every day — a salted hash, so your raw IP address is never stored — plus the per-tab session identifier above. We respect your browser’s “Do Not Track” setting, and analytics records are deleted after 180 days. Event pages also keep a simple aggregate daily total of views.
Controlling cookies
You can block or delete cookies in your browser settings at any time. Blocking strictly necessary cookies will prevent sign-in and checkout from working; blocking preference cookies simply means your language resets each visit, and clearing site data resets your theme. Buyers who block all cookies can still view their tickets — order links work without any cookie.
Changes and contact
If our cookie usage changes materially we will update this page and its “last updated” date. Questions: contact support. Related reading: our Privacy Policy.