Ticketyboo Cookie Notice
Version 1.0, in force from 4 October 2026.
The short version
Ticketyboo uses a small number of cookies and similar storage. Every one of them is there to make the site work — to sign you in, to keep you signed in, to keep bots out, and to let our payment provider check a payment for fraud.
There is no analytics, no advertising, and no tracking of any kind. That is why you are not asked to accept anything when you arrive: the law requires your consent for cookies that are not strictly necessary, and we do not set any.
You do not have to do anything. This page is here so you can see exactly what is stored, by whom, and for how long.
1. What this covers
"Cookies" is the usual shorthand, but the law covers anything stored on or read from your device by a website. That includes cookies, localStorage, and similar browser storage. Everything in scope is listed below, whichever kind it is.
This notice covers the Ticketyboo website. The Ticketyboo mobile app does not use cookies; what it stores on your phone is described in §7.
2. Why you are not asked to consent
UK law on cookies is the Privacy and Electronic Communications Regulations ("PECR"). Regulation 6 says a website must get your consent before storing anything on your device — unless what it stores is strictly necessary to provide the service you asked for.
In February 2026 that exception was rewritten to include a published list of purposes that count as strictly necessary. Authenticating you, keeping the service secure, preventing fraud, fixing faults, and remembering choices you have made on the site are all on it. Everything Ticketyboo stores falls into one of those categories.
So: a clear notice is required, and this is it. Your consent is not, and asking for it would be asking you to agree to something you cannot decline without breaking the site.
3. What is stored, and when
Nothing in §3.2 to §3.5 is stored until you do the thing that sets it. A visitor who browses shows and never signs in receives only what is in §3.1.
3.1 From your first visit
| What | Who sets it | What it does | How long |
|---|---|---|---|
__client_uat | Clerk (our sign-in provider) | Records whether you are signed in or signed out, so the site knows which version of a page to show. Contains no personal data — its value is a timestamp, or 0 when signed out | 1 year |
__clerk_environment (browser storage) | Clerk | Holds the settings for our sign-in system so the sign-in screen can load without fetching them again | Refreshed every 24 hours |
If our website is under attack, we may switch on a check from Vercel, which hosts our website, that makes sure a real browser is visiting before any page loads. While it is on, passing the check stores a record in your browser that lets you through without being checked again for one hour.
3.2 Once you sign in
| What | Who sets it | What it does | How long |
|---|---|---|---|
__session | Clerk | Your session token — this is what proves to us that you are you on every page you load | The cookie lasts 1 year; the token inside it expires after 60 seconds and is continually replaced |
__refresh | Clerk | Gets you a new session token when the old one expires, so you are not signed out every minute. Cannot be read by any script on the page | 1 year |
clerk_active_context | Clerk | Records which of your sessions is the active one | Until you close your browser |
__cf_bm, _cfuvid | Cloudflare, on behalf of Clerk | Distinguishes people from automated traffic on our sign-in provider's servers, and routes requests | 30 minutes; and until you close your browser |
3.3 When you create an account
| What | Who sets it | What it does | How long |
|---|---|---|---|
| Cloudflare Turnstile | Cloudflare, on behalf of Clerk | The "verify you are human" check on the sign-up form, which stops accounts being created automatically. It runs inside a Cloudflare frame and stores nothing on the Ticketyboo website itself. Cloudflare says the check relies on cookies and local storage in its frame to keep track of the check and of how the visitor behaves | Cloudflare does not publish this |
3.4 When you pay for a ticket
These are set by Stripe, our payment provider, and only on the payment page. If you never buy a ticket, you never receive them.
| What | Who sets it | What it does | How long |
|---|---|---|---|
__stripe_mid | Stripe | Fraud prevention — helps Stripe judge whether a payment attempt is genuine | 1 year |
__stripe_sid | Stripe | Fraud prevention, for the current visit | 30 minutes |
3.5 Other pages
| What | Who sets it | What it does | How long |
|---|---|---|---|
ticketyboo-sidebar-collapsed (browser storage) | Ticketyboo | Remembers whether you collapsed the menu, so it stays how you left it. Only written when you use the toggle | Until you clear it |
pitch_access | Ticketyboo | On our password-protected investor pages only, records that the correct password was entered. Contains no personal data | 30 days |
| Cloudflare Turnstile | Cloudflare, for Ticketyboo | The "verify you are human" check on the venue enquiry form on our page for venues, which stops messages being sent automatically. It loads when you press Send and runs inside a Cloudflare frame. Cloudflare says the check relies on cookies and local storage in its frame to keep track of the check and of how the visitor behaves | Cloudflare does not publish this |
3.6 What we do not set
- No analytics. We do not measure how you use the site, and we have no analytics product installed.
- No advertising or tracking cookies, and nothing shared with advertisers.
- Our database provider stores nothing on your device at all.
4. Who the third parties are
The ICO requires these to be named individually rather than described as "our partners". There are four.
- Clerk (clerk.com) — runs our sign-in and accounts. Sets everything in §3.1 and §3.2.
- Cloudflare (cloudflare.com) — provides bot protection. It runs the check on the sign-up form for Clerk, which chose it, and sets the two cookies in §3.2 for Clerk. It runs the same check on our venue enquiry form for us, which we chose.
- Stripe (stripe.com) — takes the payment, and sets the two fraud-prevention cookies in §3.4 on the payment page only.
- Vercel (vercel.com) — hosts our website. It stores the record of its security check in §3.1, and only while we have that check switched on.
What each of them does with data, and where that data goes, is in the Privacy Policy — this notice covers what is stored on your device, not what happens afterwards.
5. How to control them
You can delete or block cookies in your browser's settings, and every browser lets you do it — usually under "Privacy", "Cookies", or "Site data". Browsers also offer a private or incognito window that discards everything when you close it.
Be aware of what blocking breaks. Almost everything listed here is what makes signing in work. If you block cookies for Ticketyboo you will not be able to sign in, stay signed in, or buy a ticket — not because we are withholding the site, but because there is no way for us to know it is still you between one page and the next. Blocking storage on the payment page may also cause the payment to be declined, because our payment provider treats a browser it cannot check as higher risk.
There is nothing to switch off here, because there is nothing set that you could turn off and still use your account.
6. How this relates to the Privacy Policy
They answer different questions and neither repeats the other:
- This notice — what is stored on your device, by whom, and for how long.
- The Privacy Policy — what personal data we hold about you, why we are allowed to, who we share it with, how long we keep it, and what rights you have over it.
Where a cookie involves personal data, the Privacy Policy governs what happens to that data. Your rights — access, deletion, objection — are exercised through the Privacy Policy, not through this page.
7. The mobile app
The Ticketyboo mobile app does not use cookies. It stores two things in your phone's encrypted storage: your sign-in token, so you are not asked to sign in every time you open the app, and a copy of your ticket stubs, so your tickets work when the signal at the venue does not. Both are cleared when you sign out.
The app contains no advertising identifier, no analytics, and no device tracking of any kind.
8. Changes to this notice
We will update this page whenever what we store changes. The version and date are at the top.
If we ever add something that is not strictly necessary — analytics being the obvious candidate — we will ask for your consent before it is set, and this page will change to say so.
This version: 1.0, in force from 4 October 2026.