Cookies

What we do not set

This website runs no advertising cookies and no analytics trackers. There is no Google Analytics, no Plausible, no PostHog, and no other product-analytics script on the page. We do not show a cookie banner for the session cookie below: a banner for a cookie that keeps you signed in is theatre.

Session

When you sign in, EventOS sets spry_session. It is a signed token naming who you are, which organization you are acting in, and which event you are working on. It is HTTP-only, SameSite Lax, and Secure in production, and it lasts seven days. Clearing it signs you out.

Theme preference

Light or dark appearance is stored in the browser as a preference (local storage), not as a cookie. It remembers the last choice so the next visit matches. Nothing about you is sent anywhere for that.

PIN sessions on public pages

A delegation portal that is unlocked with a PIN sets spry_portal_… for four hours, limited to /portal. A share link that is unlocked with a PIN sets spry_share_…, limited to /s. Both are HTTP-only signed cookies. They exist so you do not re-enter the PIN on every click, and rotating the PIN ends them.

Signed-in admin only

The admin sidebar stores whether it is open in a cookie named sidebar_state. It is not set on public pages.

Error reporting

When this deployment is configured with a Sentry DSN, the browser loads Sentry's client. It reports crashes and a sample of performance traces (one in ten). Session replay is off. Default personal data is not sent. Requests go through this website's own origin rather than a third-party host. On the signed-in admin surface a report can include a user id so we can see who hit the error, and nothing else about that person.

If Sentry is not configured — typical of a local copy — the client does not send anything.