Cookie policy

Exhibitio is operated by Wiktis Pty Ltd. This policy names the cookies we set, what each one does, and how long it lasts. It sits alongside our privacy policy.

A cookie is a small file a website stores in your browser and reads back later. Session cookies disappear when you close the browser; persistent cookies survive until they expire or you clear them.

Cookies are how a site remembers you are signed in. Without them you would be logged out on every page.

Two different surfaces, and they behave differently:

• The app, where organizers work and buyers check out, uses only cookies that are strictly necessary to operate it.
• The marketing site, the public pages describing Exhibitio, additionally loads measurement tags so we can tell whether our advertising works.

• Authentication cookies, set by our authentication provider Supabase and prefixed sb-. They hold your signed-in session and refresh it. Without them you cannot stay signed in. They persist until you sign out or the session expires.
• exhibitio_event, which remembers which of your events you were last working on, so the workspace opens where you left it. It contains an event identifier and nothing else.
• ex_oauth_ cookies, set for ten minutes when you connect an account such as Meta Ads, Google Ads or Xero. They carry a random value used to verify that the connection request coming back is the same one that left, which is what prevents a cross-site request forgery attack. They are deleted as soon as the connection completes.

All of these are strictly necessary. There is no version of a signed-in application that works without them, which is why they are not subject to consent.

On our public marketing pages we load Google tags for analytics and advertising measurement, so we can see which campaigns bring people who sign up. These set Google's own cookies, typically prefixed _ga.

We use them to measure our own advertising. We do not use them to build profiles of individuals, and we do not sell what they collect.

Payments are processed by Stripe, and Stripe sets its own cookies during checkout to detect fraud and keep the payment session working. These are set by Stripe under Stripe's privacy policy, and they are necessary for a payment to complete safely.

Public event pages carry our essential cookies and Stripe's at checkout.

An organizer may embed our checkout in their own website. On their site, their cookie policy governs whatever else they run, and they are responsible for any consent that requires.

• We do not sell what cookies collect.
• We do not use third-party advertising cookies inside the app.
• We do not track people across unrelated websites.
• Our own analytics records a page path, an interaction type, a random session identifier and a referrer. It does not record IP addresses, names, or device fingerprints.

Strictly necessary cookies do not require consent under Australian or European rules, because the service cannot be delivered without them.

Measurement cookies on the marketing site do require consent in some jurisdictions. Where that applies to you, we ask before setting them and you can decline without losing access to anything. Declining does not affect the app.

Every browser lets you view, block, and delete cookies, usually under Settings then Privacy. You can also browse privately, which discards cookies when you close the window.

Blocking cookies for exhibitio.app will sign you out and prevent you signing back in, so the app will not be usable. Blocking measurement cookies has no effect on the app at all.

Local storage and session storage work like cookies and are used for the same purposes: keeping you signed in and remembering interface preferences. Clearing site data in your browser clears these too.

Our transactional emails may contain a delivery pixel so we can tell whether a ticket email arrived, which matters when someone says they did not receive their ticket. Blocking images in your email client stops it.

We will update this policy when the cookies we set change, and the date at the top shows the current version.

Questions go through our company page.