Cookie policy

Last updated 5 May 2026

Draft. This document was drafted by the engineering team. It has not been reviewed by qualified legal counsel and must be reviewed before public launch.

1. Categories

Essential — required for the site to function (sign-in, security, your consent choices). Always on; cannot be switched off.
Analytics — helps us understand how the site is used so we can improve it. Loaded only after you grant analytics consent.
Marketing — measures advertising effectiveness and helps us reach the right audience. Loaded only after you grant marketing consent.

2. Tracking platforms

Beyond cookies set by this site, we integrate with the following third-party tracking and infrastructure platforms. Each entry describes what the platform does, what data it processes, and how your consent controls it.

3. Google Analytics 4

Purpose: aggregate traffic analytics — pageviews, referrers, country, device class, conversion events.

Consent: only loaded after you grant analytics consent. We use Google Consent Mode v2: with consent denied, no analytics data is sent; with consent granted, standard GA4 events fire.

Data sharing: Google may transfer data outside the EU/EEA under Standard Contractual Clauses. IP anonymisation is enabled.

Opt out: revoke analytics consent in the cookie banner, or install the Google Analytics opt-out browser add-on.

4. Meta Pixel

Purpose: ad attribution and conversion measurement for campaigns we run on Facebook and Instagram.

Consent: only loaded after you grant marketing consent. If you revoke consent later, we send fbq('consent', 'revoke') and stop firing further events.

Data sharing: Meta Platforms Ireland Ltd. as controller, with onward transfer to Meta Platforms Inc. (US) under Standard Contractual Clauses. We also use Meta’s Conversions API for server-side event forwarding when consent is granted.

Opt out: revoke marketing consent in the cookie banner. To control ad personalisation across Meta properties, see your Meta ad preferences.

5. PostHog

Purpose: product analytics (which features are used, where users drop off) and client-side error capture so we can fix bugs.

Privacy-safe mode (always on): before you decide on cookies, PostHog is initialised purely for error capture with no persistent identifier, session recording disabled, autocapture disabled, IP collection disabled, and event data held in memory only.

Full mode (after analytics consent): the ph_…_posthog cookie below is set, autocapture is enabled, and product events are forwarded to PostHog’s EU instance for analysis. Session recording remains disabled by default.

Data location: PostHog Cloud EU (Frankfurt). No transfer outside the EU/EEA.

Opt out: revoke analytics consent in the cookie banner.

6. Resend

Purpose: delivery of transactional email (signup confirmation, payment receipts, OTP codes) and — only with your explicit opt-in — marketing email about future masterclass editions.

Cookies: none. Resend does not run any code in your browser. Email open and click tracking can be set per-message by us; if used, this is disclosed in the relevant email footer.

Data location: Resend (US) under Standard Contractual Clauses. Email contents and recipient address are processed for the duration needed to deliver the message.

Opt out: the marketing opt-in is separate from the cookie banner; manage it via the unsubscribe link present in every marketing email, or by replying to the email and asking us to remove you.

7. Shopify

Purpose: processes the €10 confirmation deposit for masterclass registrations. We do not see or store your card details — Shopify handles them as PCI-DSS-certified payment processor.

Cookies on this site: none. Payment is handled by redirecting you to a Shopify-hosted payment URL. Any cookies set during that flow are subject to Shopify’s cookie policy, not ours.

Webhook integration: Shopify notifies our backend when a payment succeeds; this server-to-server webhook is signed and does not involve your browser.

Data sharing: Shopify Inc. (Canada) under an adequacy decision; some onward processing in the US under Standard Contractual Clauses.

8. Cookies and storage we set

Name	Provider	Type	Purpose	Retention
`attendee_session`	This site	Essential	Keeps attendees signed in after OTP verification.	Up to 30 days
`admin_session`	This site	Essential	Keeps admins signed in to the back office.	Up to 7 days
`cookie_consent`	This site	Essential	Stores your consent choices so we don’t ask on every page.	180 days
`x9-theme (localStorage)`	This site	Essential	Remembers your light / dark theme preference.	Until you clear it
`_ga`	Google	Analytics	Distinguishes anonymous users for Google Analytics 4.	13 months
`_ga_<container-id>`	Google	Analytics	Persists the GA4 session state for the specific property.	13 months
`_gid`	Google	Analytics	Distinguishes users for the current 24-hour session.	24 hours
`_gcl_au`	Google	Analytics	Conversion attribution for Google Ads campaigns. Set only when both analytics and marketing consent are granted.	90 days
`_fbp`	Meta	Marketing	Browser-level identifier used by the Meta Pixel for ad attribution.	90 days
`_fbc`	Meta	Marketing	Last-click attribution for visitors who arrived via a Facebook/Instagram ad.	90 days
`ph_<key>_posthog`	PostHog	Analytics	Distinct identifier for PostHog product analytics. Set only after you grant analytics consent.	12 months
`ph_<key>_window_id`	PostHog	Analytics	Tab/window-scoped identifier for stitching events from a single tab.	Session (until tab closed)

9. Changing your choices

You can change your mind at any time using the Cookie settings link in the page footer. That reopens the banner with your current selections so you can save new ones. Revoking analytics or marketing consent immediately stops further events from being sent and clears the relevant cookies on the next page load.