Cookie Policy
Last updated: 8 October 2026
What are cookies?
Cookies are small text files stored in your browser when you visit a website. Similar technologies (such as localStorage) store data on your device in the same way. We use them only where necessary to operate this service, or where you have given your consent, in accordance with the EU ePrivacy Directive and the GDPR.
Cookies and similar storage we use
The table lists every cookie and storage key Pulln sets or may set. Strictly necessary items are always active because the service cannot work without them. Functional items remember a choice you made (for example the theme). Optional analytics and marketing items, and the embedded Google map, are off unless you allow them. “First party” means set by Pulln on pulln.io; “Third party” means set by the provider named.
| Name | Provider | Purpose | Category | Duration | Party | Transfer outside the EU/EEA |
|---|---|---|---|---|---|---|
| pulln_cookie_consentCookie | Pulln (Klaro consent manager) | Stores your cookie choices so we do not ask again and can honour a withdrawal. | Strictly necessary | 365 days | First party | Not applicable |
| pulln_consent_idCookie | Pulln | Random pseudonymous identifier that links your browser to its entries in our consent record (proof of consent). Contains no personal data. | Strictly necessary | 365 days | First party | Not applicable |
| pulln_consent_metaCookie | Pulln | Version and date of your last cookie choice, so we can ask again when our cookies change or after a refusal has aged. | Strictly necessary | 365 days | First party | Not applicable |
| sb-<ref>-auth-token (and .0 / .1 chunks)Cookie | Supabase (authentication, EU) | Keeps you signed in. Set only after you sign in; not set on public pages. | Strictly necessary | 400 days, renewed while you use the service | First party | Not applicable |
| sb-<ref>-auth-token-code-verifierCookie | Supabase (authentication, EU) | Short-lived secret that protects the sign-in redirect (PKCE) against interception. Removed once sign-in completes. | Strictly necessary | Removed after sign-in completes (at most 400 days if sign-in is abandoned) | First party | Not applicable |
| rsvp_<id>Cookie | Pulln | Signed token that lets a guest return to and edit their own RSVP for one invitation. Set when you submit an RSVP. | Strictly necessary | 7 days | First party | Not applicable |
| pulln_active_eventCookie | Pulln | Remembers which event you are managing after you sign in (HttpOnly). | Strictly necessary | 30 days | First party | Not applicable |
| pulln_nav_collapsedCookie | Pulln | Remembers whether you collapsed the side navigation, so the page renders correctly. Set when you toggle it. | Functional | 365 days | First party | Not applicable |
| pulln-theme-modelocalStorage | Pulln | Remembers your light or dark mode choice. Written only when you change the theme. | Functional | Until you clear it (no expiry) | First party | Not applicable |
| pulln_delegate_onboarding_completed / pulln_delegate_onboarding_dismissedlocalStorage | Pulln | Remembers which steps of the delegate onboarding checklist you finished or dismissed. | Functional | Until you clear it (no expiry) | First party | Not applicable |
| pulln-create-event-modelocalStorage | Pulln | Remembers whether you last created an event manually or with an AI-assisted draft. Written only when you pick one. | Functional | Until you clear it (no expiry) | First party | Not applicable |
| _gcl_*, IDE, test_cookieCookie | Google LLC (Google Ads) | Advertising conversion measurement. Not set unless the feature is enabled AND you accept Marketing.Only if enabled; not currently active. | Marketing | Up to 13 months (Google) | Third party | Google LLC (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| _ga, _ga_*Cookie | Google LLC (Google Analytics) | Distinguishes visitors for usage analytics. Not set unless the feature is enabled AND you accept Analytics.Only if enabled; not currently active. | Analytics | Up to 13 months (Google) | Third party | Google LLC (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| _fbp, _fbc, frCookie | Meta Platforms Ireland Ltd / Meta Platforms, Inc. (Meta Pixel) | Advertising measurement (conversion tracking). Not set unless the feature is enabled AND you accept Marketing.Only if enabled; not currently active. | Marketing | Up to 90 days (Meta) | Third party | Meta Platforms, Inc. (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| Google Maps cookies (NID, AEC and similar)Cookie | Google LLC (embedded map) | Set by Google inside the map frame once it loads. The map loads only after you click "Show map" or accept Maps in the cookie settings.Only after you allow it. | Functional | Up to 6 months (Google) | Third party | Google LLC (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
Third-party services and what is consent-gated
Not everything third-party on this site is behind the cookie banner, and we say so plainly. Optional services (the Google map, and Google or Meta advertising tags if we enable them) are not loaded, and set nothing, until you allow them. Two services run without a banner choice because they fall under a different basis:
- Cloudflare Turnstile protects sign-in, sign-up, invitation and waitlist forms against bots. It is strictly necessary for the form you asked to use and is not consent-gated.
- Sentry error monitoring runs on legitimate interest in keeping the service working. It sets no cookies and writes nothing to your device storage with our current configuration, and session replay is off.
| Service | Purpose | Consent-gated? | Legal basis | When it runs and what is shared | Transfer outside the EU/EEA |
|---|---|---|---|---|---|
| Cloudflare Turnstile Cloudflare, Inc. | Bot and abuse protection on sign-in, sign-up, invitation and waitlist forms. | No | Strictly necessary to secure the form you asked to use (ePrivacy Art. 5(3) exemption); legitimate interest in security (GDPR Art. 6(1)(f)). | Loaded only on pages with a protected form. Your IP address and browser signals are sent to Cloudflare to run the check. | Cloudflare, Inc. (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| Sentry (error monitoring) Functional Software, Inc. (Sentry) | Detects and diagnoses errors so we can keep the service working. | No | Legitimate interest in service stability (GDPR Art. 6(1)(f)). With the current configuration the browser SDK sets no cookies and writes nothing to localStorage or sessionStorage, so ePrivacy Art. 5(3) is not engaged for device storage. Session replay is off. Reports are scrubbed of personal data before sending. | Every page. Error reports are always sent; performance traces (sampled) and diagnostic logs are sent only if you accept Performance monitoring in the cookie settings. Sentry necessarily receives the connection IP address. | Hosted in the EU region (Frankfurt). Sentry is a US company, so the Standard Contractual Clauses and EU-US Data Privacy Framework apply to any access from the US. |
| Google Maps embed Google LLC | Shows the event venue on a map. | Yes, only after you allow it | Your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)), given by clicking "Show map" or enabling Maps in the cookie settings. | Event pages with a venue. Google receives your IP address and sets its own cookies once the map loads. Not loaded before you opt in, in any country. | Google LLC (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| Google Ads / Google Analytics tags Google LLC | Measuring advertising and conversions. | Yes, only after you allow it | Your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)), given in the Marketing category. | Not currently active. If enabled, the tag script is not loaded until you accept Marketing, and Google Consent Mode v2 signals stay "denied" until then. | Google LLC (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
| Meta Pixel Meta Platforms Ireland Ltd / Meta Platforms, Inc. | Measuring advertising and conversions. | Yes, only after you allow it | Your consent (GDPR Art. 6(1)(a); ePrivacy Art. 5(3)), given in the Marketing category. Pulln and Meta act as joint controllers for the collection and transmission of pixel data. | Not currently active. If enabled, nothing is loaded from Meta until you accept Marketing. | Meta Platforms, Inc. (US): EU-US Data Privacy Framework certification; Standard Contractual Clauses as fallback |
Icons and fonts are served from pulln.io itself; no font or icon request is sent to Google or any other third party.
How to manage your preferences
You can change or withdraw your cookie choices at any time, as easily as you gave them, by clicking or the “Cookie settings” link in the page footer (or, when signed in, in the profile menu). Withdrawing consent removes the cookies of that service from this site. We ask again if our cookies or services change, and after about six months if you refused. You can also clear cookies in your browser settings; this resets your preferences.
More information
For full details on how we process your personal data, read our Privacy Policy. Questions? Email privacy@pulln.io.