Operator: TOURINGTUNES Sp. z o.o., ul. Złota 7 lok. 28, 00-019 Warszawa ([privacy@strobo.events]).
This policy covers both strobo.events (the marketing site) and app.strobo.events (the product). Your cookie choice is stored on the shared parent domain .strobo.events, so a decision made on one applies to the other.
1. Categories
We group cookies and similar technologies by purpose into four categories. The first is always active; you control the other three.
Necessary (always on, no consent required): signing in and its protection against bots, language preference, the cookie-consent choice itself, your checkout and access to the tickets you bought, fraud prevention at payment, and the door scanner's offline storage. Necessary for the service to function (art. 399 ust. 3 ustawy z dnia 12 lipca 2024 r. — Prawo komunikacji elektronicznej / ePrivacy). Settings you choose yourself in the organizer panel are kept the same way. All of them are listed in §4.
Analytics (consent required): measurement of how the site is used, tied to a cookie identifier (§3), so it is pseudonymous, not anonymous. Asked once, platform-wide.
Marketing (consent required): measuring advertising performance. Two distinct uses fall here, and the banner tells you which one is asking. On event pages, the ad pixels belong to the Organizer of that event (their Meta / TikTok / Google ids): the Organizer determines what that data is used for and is the controller of it, and your consent is asked and recorded per Organizer — visiting an event by an Organizer you have not answered for yet will show the marketing question again, and pixels of that Organizer never load before you answer. Strobo loads an Organizer's pixels on that Organizer's behalf and on its instructions, as a processor under our Data Processing Agreement with Organizers (/legal/dpa); the data the pixel sends goes from your browser straight to the pixel provider, and Strobo does not keep it. Questions about how an Organizer uses that data go to the Organizer, whose contact details are shown on the event page — if you write to us instead, we pass your request on to them. On our own marketing site, this category covers measurement of Strobo's advertising. If you accepted it there and then sign up as an Organizer, our servers also report two events to Meta — the click to sign up and the completion of your organization's registration — with the Meta cookie identifiers and, for the registration, your account's email address and phone number in hashed form (Privacy Policy §2). Strobo's own Meta pixel does not load on app.strobo.events, and nothing is sent once you withdraw this category.
Session recording (consent required, separate): recordings of how you use strobo.events (what is on the page, scrolling, clicks, pointer movement), with everything you type masked. They are made with PostHog and linked to its cookie identifier, so they are pseudonymous, not anonymous, and they run only together with Analytics. This is a separate consent from marketing because recording a visitor's screen is a different purpose from measuring an ad; it cannot ride on the marketing tick.
Nothing in Analytics, Marketing or Session recording loads before you accept it. Google tools additionally run in Consent Mode v2 with every signal defaulted to "denied" until you choose.
Three kinds of measurement run without asking, because they set no cookie and leave nothing stored on your device: Vercel Web Analytics and Vercel Speed Insights on strobo.events, and our product analytics in the organizer panel. They are outside the four categories above and are described in §3A.
A promoter code from an event link is not stored on your device; §4A explains how it is used.
2. Your choices
The banner offers Accept all and Reject all as equally prominent options on the same layer, plus Settings for per-category control. Nothing is pre-ticked; there is no "legitimate interest" for marketing. Declining never blocks buying tickets. You can change or withdraw your choice at any time via Cookie settings in the footer of any page. Withdrawing a category stops further processing and reloads the page to stop tools that had already loaded; it does not undo data already collected.
3. Technologies (consent-based)
Each is loaded only after you accept its category. Ids are configured per environment; a tool with no id configured is never loaded. For Marketing tools on event pages the pixel account (id) belongs to the event's Organizer; the providers below are the tool vendors.
| Technology | Category | Purpose | Provider (controller/processor) | Typical storage | Leaves the EU? | Transfer mechanism |
|---|---|---|---|---|---|---|
Google Analytics 4 (_ga, _ga_*) |
Analytics | Aggregated visit and conversion measurement | Google Ireland Ltd / Google LLC (US) | _ga, _ga_* up to 2 years (Chrome and Edge: 400 days) |
Yes (US) | EU–US Data Privacy Framework (Google LLC certified) + SCCs |
PostHog (ph_<key>_posthog) — strobo.events only |
Analytics; Session recording | Measuring visits and clicks on our marketing site and where visitors come from. Each event carries the page address with its campaign tags and advertising click identifiers, the referring site, browser, device, language and time zone data, and an approximate location PostHog derives from the IP address. PostHog is set not to store the IP address with events. If you also accept Session recording, PostHog records the visit: what is on the page and how it is used (scrolling, clicks, where the pointer moves), with the value of every field you type into masked. The part of a recording not yet sent may wait in the browser's session storage until the next page of the visit. Recordings are kept for 30 days | PostHog, Inc. (US), our processor; data stored on PostHog Cloud EU (Frankfurt, Germany) | ph_<key>_posthog 1 year; set for strobo.events only, not sent to app.strobo.events; in session storage, until the tab is closed: ph_<key>_window_id, the visit's PostHog state and, with Session recording, the part of a recording not yet sent |
Stored in the EU (Germany); PostHog, Inc. may also process it in the US | EU–US Data Privacy Framework (PostHog, Inc. certified) + SCCs |
Meta Pixel (_fbp, _fbc) |
Marketing | Ad performance and conversion measurement (Facebook/Instagram): Strobo's own on strobo.events, the Organizer's on event pages | Meta Platforms Ireland Ltd / Meta Platforms Inc. (US) | _fbp 90 days; _fbc 90 days, set only when you arrive from a Meta ad |
Yes (US) | EU–US Data Privacy Framework (Meta certified) + SCCs |
TikTok Pixel (_ttp, ttcsid, _tt_enable_cookie) |
Marketing | Ad performance and conversion measurement (TikTok) | TikTok Technology Ltd (Ireland) / TikTok Inc. (US) and group companies | _ttp, ttcsid, ttcsid_<pixel id>, _tt_enable_cookie 13 months; in session storage, until the tab is closed: tt_appInfo, tt_sessionId, tt_pixel_session_index |
Yes (US and other third countries) | Standard Contractual Clauses (not DPF-certified) |
LinkedIn Insight Tag (li_*, bcookie, lidc) |
Marketing | Ad performance and conversion measurement (LinkedIn) | LinkedIn Ireland Unlimited Co. / Microsoft Corp. (US) | bcookie, bscookie 1 year; lidc 1 day; li_gc 180 days; li_sugr 90 days; UserMatchHistory, AnalyticsSyncHistory 30 days; __cf_bm 30 minutes, set by Cloudflare, which runs in front of LinkedIn; in local storage, with no expiry: li_adsId |
Yes (US) | EU–US Data Privacy Framework (Microsoft/LinkedIn certified) + SCCs |
Hotjar (_cs_id, _cs_s, _cs_c) — strobo.events only |
Session recording | Anonymised session recordings and heatmaps, inputs masked | Hotjar Ltd (Malta, Contentsquare group) / US sub-processors | _cs_id 13 months; _cs_s 30 min (per Contentsquare's documentation); _cs_c 13 months |
Yes (US sub-processors) | Standard Contractual Clauses |
On event pages, once you have accepted Analytics or Marketing for that Organizer, the page also keeps strobo_purchase_sent:<order> in the tab's session storage, so that a purchase is reported to the Organizer's tools only once; it disappears when you close the tab. The tools may also keep data of their own in your browser's local storage.
3A. Measurement without cookies
None of the three tools below sets a cookie or leaves anything stored in your browser, so we do not ask for consent to them and they are not part of the categories in §1.
Vercel Web Analytics (strobo.events only). Counts visits to our marketing site: the page address, the referring site, and the approximate location, browser, operating system and device type taken from the request. It sets no cookie and writes nothing to your browser. To count a visitor once, Vercel uses a hash created from the incoming request and discards it after 24 hours. It does not run on app.strobo.events: event pages, checkout, tickets and the organizer panel are not measured by it. Provider: Vercel Inc. (US), which also hosts the site (see /legal/subprocessors).
Vercel Speed Insights (strobo.events only). Measures, for a share of visits, how quickly the pages of our marketing site load and respond: page load timings and Core Web Vitals (such as when the main content appears, whether the layout shifts and how quickly the page reacts to a tap), with the page address, the type of network connection the browser reports, the part of the page a measurement concerns, a random identifier of that page load that is not kept on the device, and the approximate location, browser, operating system and device type taken from the request. It sets no cookie and writes nothing to your browser. It does not run on app.strobo.events: event pages, checkout, tickets and the organizer panel are not measured by it. Provider: Vercel Inc. (US), which also hosts the site (see /legal/subprocessors).
Product analytics in the organizer panel (app.strobo.events, organizer panel only). When a signed-in Organizer or a member of their team uses the organizer panel or its onboarding, we record which panel pages they open (the address without anything after the "?"), how long they stay on a page and how far they scroll, which buttons and links they use and where on the page, and the browser, operating system, device type and screen size, so that we can improve the panel. Each event carries the identifier of the user account and a random identifier for the visit that is not kept on the device; it carries no name or email address. The events leave out where the Organizer came from (referring site, campaign tags), the page title, and the text and attributes of whatever is clicked, which are masked before anything leaves the browser. No location is derived: each event tells PostHog not to look up the IP address, and PostHog is set not to store the IP address with events. Sessions are not recorded. It does not run anywhere else: not on event pages, at checkout, on ticket pages or in the door scanner. It keeps nothing on the device (no cookie, no local storage) and does not read other tools' advertising cookies. The legal basis is our legitimate interest in improving the service (Art. 6(1)(f) GDPR); you can object at any time by writing to [privacy@strobo.events]; we then stop product analytics for your user account. Provider: PostHog, Inc., with the same hosting and transfer mechanism as in the §3 table.
3B. Embedded players
An event page can show music and video players from Spotify, SoundCloud, YouTube and Bandcamp that the event's Organizer added, and the line-up can show an artist's player. None of them loads with the page. Each shows a button first, and your browser contacts the provider only when you press it. The one exception is a YouTube player's preview image, which your browser fetches with the page from YouTube's image server (i.ytimg.com). Once you press the button, the player loads from the provider's own site (open.spotify.com, w.soundcloud.com, www.youtube-nocookie.com or bandcamp.com). The provider then receives your IP address and browser details. It may store or read its own cookies and similar data on your device under its own privacy and cookie policy, and it decides what that data is used for. Strobo receives nothing from the player. Because a player loads only when you ask for it, it is not one of the banner categories in §1, and refusing cookies in the banner leaves the button in place.
4. Necessary cookies and local storage
Everything below is stored without asking, because the part of the service you are using cannot work without it, or because you set it yourself with a click (a setting in the organizer panel). None of it is used for analytics, marketing or recording. The law asks us to tell you about what is stored on your device even when it is necessary (art. 399 PKE), so all of it is listed here: the name, where it is kept, what it is for and how long it stays.
Signing in (Organizers and their team; Clerk is our sign-in provider, see /legal/subprocessors)
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
__session, __session_<suffix> |
Cookie, app.strobo.events | Proves that you are signed in. The signed token inside it is valid for about a minute and is renewed while the app is open | 1 year |
__client_uat, __client_uat_<suffix> |
Cookie, .strobo.events |
The time you last signed in or out ("0" when signed out), so the app knows whether to check your sign-in; it is not a secret | Up to 10 years (Chrome and Edge: 400 days) |
clerk_active_context |
Cookie, app.strobo.events | Which of your organizations is open in the panel | Until you close the browser |
__client |
Cookie, clerk.strobo.events | Your sign-in with Clerk. It is also set on the sign-in page before you sign in | Up to 10 years (Chrome and Edge: 400 days) |
__cf_bm |
Cookie, clerk.strobo.events | Protects the sign-in against bots. Set by Cloudflare, which runs in front of Clerk's sign-in service | 30 minutes |
__cf_bm |
Cookie, img.clerk.com | The same protection for Clerk's image server, from which the sign-in page loads its images. Set by Cloudflare, as above | 30 minutes |
_cfuvid |
Cookie, clerk.strobo.events | Limits how many requests one visitor can send to the sign-in service. Set by Cloudflare, as above | Until you close the browser |
__clerk_environment |
Local storage, app.strobo.events | Clerk's settings for our sign-in form; it holds no personal data | No expiry; Clerk refreshes it |
<suffix> is a fixed code that identifies our sign-in setup and is the same for every visitor.
Strobo
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
NEXT_LOCALE |
Cookie, app.strobo.events | Your language | 12 m |
strobo_consent |
Cookie, .strobo.events (shared by strobo.events and app.strobo.events) |
Stores your cookie choice, written when you answer the banner or use Cookie settings | 13 m |
strobo_anon |
Local storage of the site where you answered | A random identifier (no name, email or profile) tying your successive consent decisions to one record, so we can demonstrate what you chose and when | No expiry — persists until you clear site data |
__Host-strobo_checkout_session |
Cookie, app.strobo.events | Created when you press Buy. It ties the tickets reserved for you to this browser, so that only you can pay for them; the reservation itself is kept on our servers | 24 hours |
__stripe_mid, __stripe_sid |
Cookie, app.strobo.events | Set by Stripe, our payment provider, on the checkout page to detect fraudulent payments | __stripe_mid 1 year; __stripe_sid 30 minutes |
__Host-strobo_ticket_claims |
Cookie, app.strobo.events | Opens the tickets you bought in this browser after you follow the link in your ticket email, without an account | 180 days, renewed when you open the link again |
__Host-strobo_ticket_holds |
Cookie, app.strobo.events | The same, for tickets someone has passed on to you | 180 days |
Checkout, on Stripe's sites (the payment form at checkout is loaded from Stripe's own sites, js.stripe.com and m.stripe.network; what is listed here is stored by Stripe, our payment provider, and by the services it uses, for its fraud prevention and under their own privacy policies)
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
m |
Cookie, m.stripe.com | Stripe's fraud prevention for payments made from this browser | Up to 2 years (Chrome and Edge: 400 days) |
| Stripe's fraud-prevention data | Session storage, m.stripe.network | The same, for this visit | Until you close the tab |
hmt_id |
Cookie, api.hcaptcha.com | hCaptcha, a check that tells people from bots, which Stripe runs inside the payment form as part of its fraud prevention | 30 days |
__cf_bm |
Cookie, .hcaptcha.com |
Protects hCaptcha against bots. Set by Cloudflare, which runs in front of hCaptcha | 30 minutes |
__cflb |
Cookie, api.hcaptcha.com | Sends your requests to the same hCaptcha server. Set by Cloudflare, as above | 30 minutes |
When the payment form offers Google Pay or Apple Pay, that option comes from Google or Apple: the Google Pay button is loaded from Google's own sites (pay.google.com, play.google.com, www.gstatic.com), and Apple Pay is provided by Apple through your browser. Google and Apple then receive your IP address and browser details and may store or read their own data on your device under their own privacy policies.
Organizer panel (written only when you do what is described; a setting you choose yourself needs no consent)
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
strobo_attention_folded |
Cookie, app.strobo.events | Remembers that you folded the "Needs attention" block on Home, per organization: the organization's identifier and the kinds of open items, nothing else; up to 10 organizations | 12 m |
strobo:presentation |
Local storage | Presentation mode (buyers' details blurred) is on | Until you switch it off |
strobo:legal-notice-dismissed:<version> |
Local storage | You closed the notice about new Terms for that version | No expiry |
strobo:legal-notice-closed-this-session |
Session storage | You closed that notice during this visit | Until you close the tab |
strobo:panel-install-dismissed |
Local storage | You closed the hint to install the panel as an app | No expiry |
strobo:event-draft:<organization id> |
Local storage | The "Create event" form you have not saved yet, so that a reload or a closed tab does not lose it. It stays on your device | Until you create the event or discard what you typed; not offered back after 6 days |
Door scanner (on the phones of the Organizer's door staff, after the door PIN)
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
__Host-strobo_door_<event id> |
Cookie, app.strobo.events | The door session opened with the PIN | Until the PIN expires, at most 12 hours |
strobo-door |
IndexedDB | The event's entry list (tickets and guest-list entries, with the holder's name where there is one) and the scans not yet sent, so that the door keeps working without signal | The list: deleted the first time the scanner or the PIN pad is opened on that phone more than 48 hours after the event ended, and when the PIN is revoked or the scanner is signed out. Scans not yet sent: until they reach our servers |
strobo-door-v1, with the service worker door-sw.js |
Cache storage | The scanner page and its barcode decoder, so that the scanner opens without signal; no ticket data | Until a newer version replaces it or you clear site data |
strobo_door_device |
Local storage | A random label for the phone, saved with each scan so that the Organizer can tell which device admitted a ticket | No expiry |
strobo:door-install-dismissed |
Local storage | You closed the hint to install the scanner as an app | No expiry |
strobo_anon is a persistent identifier in your browser's local storage. It is written the first time you answer the banner — including if you refuse everything — because it is what evidences your refusal and lets us avoid re-asking you. It is strictly necessary for that purpose, carries no identifying data, and is never used for analytics, marketing or recording. It has no expiry and remains until you clear your browser's site data for this site.
4A. Promoter links
An Organizer can give a promoter a link to an event with a code in it (?pc= followed by the code). The code stays only in the page address: when you press Buy on that page, it is carried in the address of the checkout and read when you pay, so that the order records which promoter's link you came from and the Organizer can settle with the promoter. Nothing is stored on your device for this, and the code holds nothing about you. If you leave and come back later without the link, the purchase is not credited to the promoter. Opening another promoter's link replaces it. If you accepted marketing or analytics for that Organizer, their pixels see the page address, code included. A browser that still holds the strobo_pc cookie we used for this before 21 October 2026 has it deleted on its next visit, without its content being read.
5. Consent record
We keep an auditable record of consent decisions (a random identifier, the time, the categories chosen, the Organizer the marketing consent was given for, the wording version, IP, user agent and which surface asked) to demonstrate consent as required by GDPR Art. 7(1). This record is retained for 24 months and then deleted; IP and user agent are kept only as evidence of the decision.
6. Contact
Questions: [privacy@strobo.events]. See also the Privacy Policy at /legal/privacy.