Cookies and storage

The law here is not only about cookies. It covers anything a website stores on your device or reads back off it, including browser storage that is not a cookie. This page lists all of it.

The short version

We store a small number of things on your device, all of them to make a feature you asked for work. There is nothing here for analytics, advertising, or profiling, so there is nothing to consent to and no banner to dismiss.

Everything this site stores on your device

Name	Type	What it is for	What it holds	How long
`on_city`	Cookie	Opens the homepage on your city after you allow location	One city name from a fixed list. No coordinates	90 days
`on_location_asked`	Browser storage	Remembers you have been asked about location, so we ask once	The word `yes`	Until you clear site data
`ticketsub.saved.v1`	Browser storage	Your saved events	The events you saved, on your device only	Until you clear site data
`ticketsub-submit-draft-v1`	Session storage	Keeps a half-finished submission if the page reloads	What you had typed	Until you close the tab
`search:map-open`	Session storage	Remembers the map was open so filtering does not close it	`1` or `0`	Until you close the tab
`sb-…-auth-token`	Browser storage	Keeps you signed in, if you have an organiser account	Your sign-in session	Until you sign out or it expires

Staff who sign in to the admin tools get one further cookie, ts_admin. It is never set for visitors.

What we do not use

No analytics of any kind, including the sort that calls itself privacy-friendly.
No advertising or marketing tags, pixels, or conversion tracking.
No third-party cookies.
No social sharing or embed widgets.
No fonts loaded from another company’s servers.
No session recording, heatmaps, or fingerprinting.

Where your browser connects

Besides the servers that deliver the site itself, two companies receive requests from your browser. Supabase is our database and file host. The database is in Ireland; stored files, which means listing pictures, are served through a global content delivery network. OpenStreetMap is a UK foundation, served through a global content delivery network. Each sees your IP address when your browser asks it for a file, as any site you visit would.

Listing pictures are the part that happens with no action from you. Where an organiser has given us a photo and we have approved it, your browser fetches that file from Supabase as the page loads, which discloses your IP address to Supabase. That is close to half of our event pages and nearly every page that lists several at once. Where there is no approved photo we draw the artwork ourselves and serve it from this site.

Signing in reaches Supabase directly too, and only on the pages for an organiser account: claiming a listing, submitting an event, and the dashboard. Your email address and your code go from your browser to Supabase, and the session comes back. That is the sb-…-auth-token row above. No listing page loads that code at all.

The search map is off until you press “Show map”. Nothing map-related loads before that. When you do press it, map tiles come from OpenStreetMap. Map pins are city-level only. Venue positions are never sent to your browser, so the map cannot show where a specific venue is. If you never open the map, no request to OpenStreetMap is ever made.

How to remove any of it

Clear the site’s data in your browser settings, or use private browsing. Everything in the table above is removable this way, and the site keeps working without it. Your saved events are the only thing you lose, because they only ever existed on your device.

What we do with information once it reaches us is set out in the privacy notice.