Eventually Ticketing
Legal & Compliance

Cookie consent and preference center

Eventually displays a cookie consent banner on the authenticated app and on public event, series, and post-purchase pages. The banner asks visitors in certain regions to choose which cookie categories they accept. Visitors can change their choice at any time from the app user menu or the banner itself.

Who sees the banner

Consent behavior is geo-targeted based on the visitor’s country. Visitors in the European Economic Area, the United Kingdom, Switzerland, and unknown countries are shown the banner and must choose before non-essential cookies load. Visitors everywhere else are treated as consented by default and are not shown the banner, but they can still change their preferences in the app.

The preference center and banner offer three categories:

  • Necessary — Required for sign-in, security, and checkout. Always enabled. The product does not work without these.

  • Functional — Remembers preferences like sidebar state, theme, form pre-fill, and enables support chat.

  • Performance and Analytics — Product usage analytics that help us improve Eventually. Never used for advertising.

What each category controls

The following product behaviors are gated on consent decisions:

  • Functional consent enables Intercom support chat and attendee form pre-fill on return visits.

  • Performance and Analytics consent enables PostHog, Fathom, and Google Analytics 4 page-visit analytics and affiliate referral tracking.

  • Necessary cookies are never gated and always load.

Changing preferences in the app

When you are signed in, the user menu includes a Cookie preferences item that reopens the preference center. From there you can accept or reject each category and save your choice. Mid-session changes take effect immediately. Rejecting Functional or Performance and Analytics deletes the cookies and browser storage that category had already stored, not just future loading. Rejecting Functional removes remembered preferences such as sidebar state and attendee form pre-fill, and deletes any unsaved event wizard draft. Necessary cookies and your saved consent choice are never removed.

Changing preferences on public pages

Public event pages, series pages, and post-purchase completion or confirmation pages show a compact consent banner. When you are signed out, you can reopen the preference center at /cookies. Click Customize to expand the categories, then choose Only necessary, Accept all, or Save choices after selecting individual categories.

Widget embeds

Embedded calendar widget iframes on your Squarespace site do not show the consent banner. The banner appears only on top-level public pages hosted on Eventually.

The complete cookie policy lists every cookie and storage item we use. The following items are disclosed in our security and compliance reviews:

  • Google Analytics 4 — _ga and _ga_* cookies on the marketing site.

  • Cloudflare Turnstile — cf_turnstile_* cookies and localStorage for bot protection on public pages.

  • Widget attendee info — ev-attendee-info localStorage in the embedded calendar widget to pre-fill attendee forms.

  • Consent cookie — ev_cookie_consent_v1, stored for 12 months.

  • Session cookies — _eventually_session and session_token for authentication.

  • Stripe — __stripe_mid and __stripe_sid for checkout fraud prevention.

  • Intercom — intercom-id-*, intercom-session-*, and intercom-device-id-* for support chat when functional consent is granted.

  • PostHog — ph_<token>_posthog cookie and ph_<token>_* localStorage when analytics consent is granted.

  • Cloudflare — __cf_bm and cf_clearance for security and performance.

For the full list, see the Legal policy page reference.

Your choice is stored in a first-party cookie named ev_cookie_consent_v1 with a 12-month retention. The cookie contains the consent version, a timestamp, and the enabled categories. When the cookie expires, visitors in opt-in regions are asked again.

Each consent decision is logged server-side with the chosen categories, source page, banner version, IP address, country, and user agent. These records are not linked to user accounts, so they survive account deletion and serve as compliance evidence.

Was this helpful?
Was this helpful?