Effective August 27, 2026 · Version 1.0
Cookie policy
This policy describes cookies, browser storage, pixels, and similar technologies used by Who Attends.
1. Summary
Necessary storage keeps authentication, security, and your privacy choice working. Analytics is always active. You can reject or withdraw marketing consent without losing access to the website or product.
2. What these technologies are
Cookies are small text records stored by your browser. Local and session storage are similar browser facilities. Pixels and scripts can send an event to a provider when you view a page or take an action.
3. Storage and providers
Who Attends and Better Auth
Necessary- Names:
- Session, CSRF, and security cookies. Names can use a secure prefix.
- Purpose:
- Keep you signed in, prevent request forgery, and protect the account.
- Duration:
- Short-lived for security state. Authenticated sessions last up to 7 days.
Stripe
Necessary when checkout is requested- Names:
- Checkout and fraud prevention storage on Stripe-controlled pages
- Purpose:
- Process payment, prevent fraud, collect billing details, and create an invoice.
- Duration:
- Depends on the Stripe technology and legal or security need. See Stripe's privacy information.
Who Attends
Necessary- Names:
- wa_privacy and who-attends:privacy-consent:v1
- Purpose:
- Remember your marketing choice.
- Duration:
- 180 days, or until you clear browser storage.
PostHog
Analytics, always active- Names:
- ph_<project>_posthog and related first-party analytics storage
- Purpose:
- Distinguish pseudonymous sessions, measure product use, and provide masked session replay when enabled. Replay masks all text and inputs and excludes request bodies.
- Duration:
- Up to 12 months under the intended configuration, or earlier withdrawal or deletion.
Google Analytics and Google Tag Manager
Analytics, always active- Names:
- _ga and _ga_<measurement-id>
- Purpose:
- Distinguish pseudonymous visitors and report website use.
- Duration:
- Up to 2 years under Google's default duration, subject to the configured retention.
Meta Pixel
Marketing, consent required- Names:
- _fbp and, after an advertisement click, _fbc
- Purpose:
- Attribute visits and conversions and measure campaigns.
- Duration:
- Usually up to 90 days according to Meta's published cookie information.
Google advertising tools
Marketing, consent required- Names:
- _gcl_au, _gcl_* and related Google advertising identifiers
- Purpose:
- Attribute advertisement clicks and conversions.
- Duration:
- Usually up to 90 days for first-party conversion storage. Google-controlled storage can vary.
4. Consent and legal basis
Under § 165(3) of the Austrian Telecommunications Act 2021 and the ePrivacy rules, storage or access that is not technically necessary needs prior consent. Consent is also the legal basis under Article 6(1)(a) GDPR when the tool processes personal data.
Analytics starts automatically. The marketing choice gives equal access to acceptance and rejection. We keep your choice for 180 days. We ask again after it expires or after a material purpose change.
5. Withdraw consent
Use "Privacy choices" in the footer or the button above. Withdrawal applies to future processing. When you refuse a category, we notify loaded providers and remove known first-party tracking storage that your browser lets us remove.
We treat Global Privacy Control as a refusal of marketing tracking. You can also block or delete cookies in browser settings. Blocking a necessary session cookie can stop sign-in from working.
6. Provider information
The Austrian Data Protection Authority guidance states that tracking cookies are not technically necessary and need consent before use.