1. What cookies and local storage are
Cookies are small values sent to the browser, while localStorage is local space controlled by the browser. The platform uses these mechanisms to preserve cart continuity, provide authentication, secure checkout, and support operational functions.
This policy is updated, with a new version and date, whenever a cookie or storage item is added or removed or changes purpose.
2. Strictly necessary storage identified in the application
The durations above describe the technical configuration observed for the current version and do not, by themselves, justify longer retention in other systems. Session cookies are set with measures such as HttpOnly, SameSite, and Secure under the production configuration.
Sessions and checkout
- euphoria_customer_session - customer account session; configured technical duration: no more than 30 days.
- euphoria_customer_signed_in - readable marker that a customer session exists, used only to show the account link in the site menu; it holds no account details; configured technical duration: until the browser is closed or the customer session ends.
- euphoria_portal_session - partner portal session; configured technical duration: no more than 12 hours.
- euphoria_staff_session - authorized staff session; configured technical duration: no more than 12 hours, or no more than 30 days for accounts limited to checking tickets at the door.
- euphoria_checkout_client - technical identifier used to reserve and protect checkout; configured technical duration: no more than 90 days.
- eu_event_save_id - random identifier set only when a visitor who is not signed in saves an event, so the saved events stay on this browser and move to their account when they sign in; configured technical duration: no more than 12 months.
- euphoria_google_oauth_state - protects the Google sign-in exchange against forgery; set only when Google sign-in is offered and used, which is not the case at present; configured technical duration: 10 minutes, and it is deleted when sign-in completes.
Language and cookie preferences
- euphoric_locale - remembers the site language; it is set when a language is chosen and when a cookie choice is saved; configured technical duration: no more than 12 months.
- euphoric_cookie_consent - records the selected cookie category and the applicable notice version; configured technical duration: no more than 6 months.
Browser storage
- euphoria.cart.v1 - locally stores the event, category, quantity, and price in the cart; it is removed after eligible completion of checkout or when browser data is cleared.
- euphoria-form:<page address> - a temporary copy, kept only in this browser, of what is typed into a form, so that it is not lost if the page reloads; passwords, files, and fields marked not to be kept, such as the email fields of the sign-in, support, and artist application forms, are never copied; the copy is cleared when the page confirms that the form was sent, and a copy older than 24 hours is deleted the next time the site is opened in this browser. On a shared computer, clear the browser's site data after using a long form.
- euphoria-scanner-profile-v1 - local operational preference for authorized scanning devices; it is not intended for ordinary visitors.
3. External services and checkout
Card and wallet payments, including Revolut Pay, run on Stripe's hosted payment page. Stripe sets its own cookies on its own domain for payment, fraud prevention, and security, as its notice describes.
Providers reached from the platform, with their own notices: Vercel (https://vercel.com/legal/privacy-policy); Supabase (https://supabase.com/privacy); Stripe (https://stripe.com/privacy); Resend (https://resend.com/legal/privacy-policy); Oblio (https://www.oblio.eu/politica-de-confidentialitate); Google (https://policies.google.com/privacy); Meta (https://www.facebook.com/privacy/policy/).
Cookies set by the platform itself, all strictly necessary: euphoric_locale — remembers the site language; euphoric_cookie_consent — records the visitor's cookie choice and the applicable notice version; euphoria_customer_session — keeps a buyer signed in to their account and tickets; euphoria_customer_signed_in — tells the site menu that a buyer is signed in, so it links to their account; holds no account details; euphoria_checkout_client — ties a checkout attempt to the browser that started it; eu_event_save_id — keeps the events a visitor saves without signing in, on this browser, until they sign in; euphoria_google_oauth_state — protects the Google sign-in exchange against forgery; euphoria_staff_session — keeps door and office staff signed in to internal tools; euphoria_portal_session — keeps an organizer signed in to the partner portal. Card payment runs on the provider's hosted checkout, so any payment cookies belong to that provider's domain rather than this one.
4. Analytics, advertising, and other non-essential technologies
Analytics and advertising cookies are off by default. The banner offers “Essential only”, “Analytics only”, and “Accept all”; nothing optional loads until you choose, and no purchase depends on accepting them, in line with Law No. 506/2004 and the GDPR.
You can change your choice at any time through “Cookie preferences” in the site footer, and withdrawing consent is as easy as giving it; the related cookies are then deleted from this site. Meta and Google may also read or set cookies on their own domains under their own notices.
Google Analytics 4 (active, optional)
- Loads only after you choose “Accept all” or “Analytics only”, and measures only public pages: never account, ticket, checkout, sign-in, partner, staff, or scanning pages.
- The platform sends it the page address without personal parameters, the page title, and campaign labels (UTM). On those pages, Google's script can also record moves between pages, scrolling, clicks on links to other sites, file downloads, and when a form is started or sent.
- Google signals, ad personalisation, and the sharing of user data for advertising are switched off.
- Cookies: _ga and _ga_*, for up to 180 days.
- Google's notice: https://policies.google.com/privacy.
Meta Pixel for Facebook and Instagram (active, optional)
- Loads only after you choose “Accept all”, never after “Analytics only”.
- The platform reports to Meta only visits to public pages, so that Meta can build remarketing audiences. It sends no purchase, order value, name, or email address, and it turns off the script's automatic reporting of page changes, button clicks, and page details.
- With each visit, Meta's script also receives the full page address, your IP address, and browser details, and Meta may link the visit to a Facebook or Instagram account.
- Cookies: _fbp and, when you arrive from an ad, _fbc, for up to 90 days.
- For collecting and sending this data, Meta and the platform are joint controllers; the Privacy Policy explains the arrangement. Meta's notice: https://www.facebook.com/privacy/policy/.
Google Ads (not active)
- Google Ads conversion tracking is built in but not switched on, so its _gcl_au cookie is not set. This policy will be updated before it is switched on.
5. How they can be managed
- Cookie preferences can be changed at any time through “Cookie preferences” in the site footer.
- Cookies and localStorage may be cleared through browser settings.
- Blocking strictly necessary storage may prevent authentication, cart retention, checkout, or portal access.
- Settings must be repeated in each browser or device and may be lost when local data is cleared.
6. Legal basis, duration, and updates
Storage needed for the service to work is assessed separately from optional technologies. Your choice and the notice version are recorded in the euphoric_cookie_consent cookie in your browser; no separate record of the choice is kept on the platform's servers. Withdrawing consent is as easy as giving it.
The duration of each item is limited to its purpose and reviewed periodically. Every change to the inventory receives a new version of this policy. Your consent is asked for again only when an optional category or its purpose changes.
7. Contact and questions
For questions about cookies and browser storage, use the support form at /support or write to management@euphorictickets.ro. The operator is ART STUDIOS MANAGEMENT S.R.L., Tax ID (CUI) 53262231, registered in Romania.
Personal data requests go through the same channels, as /gdpr explains. Never send session identifiers, sign-in links, or QR codes.