Cookies and devices
Essential storage and user-requested third-party content
Last updated 17 August 2026 · Version 2026-08-17
1. Technologies currently used
| Provider or category | Purpose | Typical duration | Why no consent |
|---|---|---|---|
| FormSide / Supabase authentication | Keep an organiser or family account securely signed in and refresh the authenticated session. | For the signed-in session, until sign-out or session expiry and refresh limits. | Strictly necessary for the account service requested. |
| Cloudflare Turnstile | Distinguish a genuine booking attempt from automated abuse and protect limited camp places. | Short-lived challenge and security information. | Necessary security for the booking service requested. |
| Stripe hosted checkout | Process a card payment after the user deliberately chooses card checkout. | Set and controlled by Stripe on its hosted service. | Necessary to complete the chosen payment; Stripe supplies its own notice. |
| OpenStreetMap interactive map | Show an interactive venue map only after the visitor selects “Load map”. | Controlled by OpenStreetMap after activation. | No embed request is made until the visitor asks for this specific content. |
| YouTube privacy-enhanced mode or Vimeo | Show an organiser-supplied gallery video only after the visitor selects “Load video”. | Controlled by the selected video provider after activation. | No embed request is made until the visitor asks for this specific content. |
Cookie names and exact expiry can vary with the production authentication and security configuration. We audit the deployed service rather than copying a generic list that may be inaccurate.
2. What we do not currently use
- Behavioural advertising or cross-site tracking pixels.
- Third-party audience profiling.
- Non-essential heatmaps, session replay or marketing analytics.
- Browser local storage or session storage for advertising or profiling.
- Automatically loaded third-party map or video embeds.
3. Your choices
A browser can block or delete cookies, but blocking essential authentication or security storage may prevent sign-in, booking or payment. You can sign out to end an authenticated session. You can leave maps and videos unloaded and use the plain venue address or external link instead. If optional analytics or marketing technology is introduced, FormSide will offer an equally clear accept and reject choice and make withdrawal as easy as consent.
4. More information
The ICO guidance on storage and access technologies explains the current PECR rules and exemptions. Questions about the deployed FormSide configuration can be sent to privacy@formside.app.