Cookie Policy

These are set by the sign-in system when you sign in, and only then. Visitors who never sign in get none of them.

• __Secure-authjs.session-token

  Keeps you signed in. Holds a random session ID, not your email or name.

  Lasts: 7 days, extended each day you visit. Gone when you sign out.

• __Host-authjs.csrf-token

  Protects the sign-in form from being submitted by another site on your behalf.

  Lasts: Until you close the browser.

• __Secure-authjs.callback-url

  Remembers which page to send you back to after signing in.

  Lasts: Until you close the browser.

• __Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce

  Set only while you sign in with Google, Discord or Twitch, so the answer that comes back is the one we asked for.

  Lasts: 15 minutes.

Team members who use the Dashboard have a few extras. These never appear for attendees. The desk storage can hold attendees' badge names, which is why desks run on team laptops and are cleared after the event.

• visitor_preview

  Lets a team member see the site the way a visitor does. It only ever takes access away.

  Lasts: 2 hours.

• 20xxpo-desk-name, 20xxpo-register-name (browser storage)

  The name a registration desk or merch counter gave itself, so its records say which desk did what.

  Lasts: Until cleared in the browser.

• 20xxpo-registration-desk (browser database)

  A saved copy of the badge list and prices, and any hand-overs or cash sales made while the venue Wi-Fi was down, waiting to be sent.

  Lasts: Until the desk clears it or the browser data is cleared.

Paying. Checkout happens on a page run by Stripe, our payment processor. Stripe sets its own cookies there for fraud prevention and to make the form work. They are covered by Stripe's privacy policy. Nothing from Stripe is loaded on our own pages.

Signing in with Google, Discord or Twitch. You sign in on their site, and they set their own cookies there under their own policies. We receive only your email, name and profile picture, and we keep our own copy of the picture so your browser never loads it from them while you use our site.

Videos. Some pages embed a YouTube or Twitch player. The YouTube player uses YouTube's privacy-enhanced mode, which sets no cookies until you press play. The Twitch player and Twitch chat on our Watch pages are run by Twitch and set Twitch's cookies as soon as they load; Twitch's policy covers those. If you would rather not have them, do not open the Twitch pages, or block third-party cookies in your browser (the stream still plays).

Map. The Venue page has a Google map that loads only when you press "Show map". Until then nothing is sent to Google; once it loads, Google may set its own cookies, covered by Google's privacy policy.

Fonts. The site's fonts are served from our own server, so no font company sees your visit.

Signing out removes the sign-in cookie. Your browser can show, delete or block cookies for any site: look for "cookies and site data" in its settings. If you block ours you will not be able to stay signed in, but every public page still works. We do not respond to "Do Not Track" signals because there is nothing to turn off.

When this list changes, we update the date at the top. If we ever add something optional (for example, an analytics tool), we will ask your permission first. What we do with what the cookies help us collect is in the Privacy Policy. Questions: the contact form, email legal@20XXpo.com, or write to LemonAID Events, 3715 196th St SW #2212, Lynnwood, WA 98036.