The Legal Hub.

2.1 Strictly Necessary (Always Active)

These cannot be switched off — without them you cannot stay signed in or pay.

• pxi_paseto: your signed-in session (PASETO v4 token). HttpOnly, Secure, SameSite=Lax. Cleared when you log out.
• __stripe_mid / __stripe_sid: set by Stripe for payment fraud prevention, and only on pages where you are checking out.

2.2 Analytics

_ga and _ga_<id>, set by Google Analytics 4, to count visitors and understand which pages and features get used. Google Analytics 4 does not log or store IP addresses, and we do not send it your name, email, or phone number.

2.3 Advertising

We do use advertising cookies. They let us measure which ads lead to signups and ticket sales, and let us show PXI ads to you on other websites and apps (remarketing). None of them are set unless you have consented — see 2.7.

• Google Ads. _gcl_au (conversion linker), plus cookies set by googletagmanager.com and doubleclick.net.
• Meta (Facebook and Instagram). _fbp (a browser identifier Meta uses to recognise you across sites) and _fbc (recorded only if you arrived from a Meta ad). These are what allow a PXI ad to reach you on Instagram or Facebook after you have visited this site.
• TikTok. _ttp and _tt_enable_cookie, used the same way for ads on TikTok.
• X (Twitter). personalization_id and muc_ads.

When you buy a ticket we may send Google a hashed, irreversible (SHA-256) version of your email address and phone number so a conversion can be matched to an ad click. The hashing happens in your browser: Google receives only the digest, never the address or number itself. This is skipped entirely if you have opted out.

From your browser, we send no identifying information to Meta, TikTok or X — those pixels receive only the page you viewed and the value of the ticket, never your name, email or phone number. Separately, when a ticket purchase completes, our servers send Meta and TikTok a hashed, irreversible (SHA-256) version of your email address, phone number and PXI user id so the sale can be matched to the ad that led to it. The plaintext never leaves PXI, the digest cannot be reversed, and nothing is sent for a purchase made by someone who has opted out.

2.4 Campaign Attribution (First-Party)

pxi_attribution, set by us and readable only by us, stores for up to 90 days the campaign tags and ad-click identifiers (utm_*, gclid, gbraid, wbraid, fbclid, ttclid, twclid, msclkid) plus the site that referred you, so we can tell which campaign brought you to PXI. It is written only if you have not opted out.

2.5 Local Storage

Not cookies, but stored on your device the same way: pxi_consent_v2 (your cookie choice — necessary, since it is how we remember to stop), pxi_user (your profile, cached so the app can render while signed in), and pxi_pending_deeplink (the page you were heading to before being asked to log in).

2.6 Third Parties

Google (Analytics, Ads, Tag Manager), Meta Platforms, TikTok, X Corp. and Stripe (payments) set cookies under their own privacy policies, and the four advertising partners may combine what they learn here with data they already hold about you on their own platforms. Cloudflare R2 stores and delivers event media for us, and Netlify hosts this website; neither sets advertising cookies on you here.

2.7 Your Choices

Use the Cookie settings link in the footer of any page on pxispace.com. It works in every country, whether or not you were shown a banner, and you can change your answer as often as you like. Choosing Reject all switches off analytics and advertising storage, tells Meta and TikTok to stop collecting immediately, and deletes the cookies named in 2.3 and 2.4 that we are able to remove (pxi_attribution, _fbp, _fbc, _ttp, _tt_enable_cookie, personalization_id, muc_ads). Everything in 2.1 stays, and the site works exactly the same.

If you are in the EEA, the UK, or Switzerland, nothing in 2.2–2.4 is set until you accept: those categories start denied and we ask you on your first visit.

You can also clear or block cookies in your browser settings, though that will sign you out.

2.8 Global Privacy Control & Do Not Track

We honour the Global Privacy Control (GPC) signal. If your browser or extension sends it, we treat it as an opt-out of analytics and advertising storage — including as a request to opt out of “sale” or “sharing” under the CCPA/CPRA — without you having to do anything else. We treat a legacy DNT: 1 header the same way. If you later press Accept all in our banner, that explicit choice takes precedence for this site.