Cookie Policy
Last updated: September 10, 2026 · Operator: Nyza Creations LLC
2. How we use cookies
We use cookies for a narrow set of purposes: keeping you signed in, protecting your account from cross-site request forgery, remembering your preferences (such as theme and time zone), and understanding aggregate, anonymized usage of the Service so we can keep it fast and improve it. We do not use cookies for third-party advertising or cross-site tracking.
3. Categories of cookies we use
- Strictly necessary — required for the Service to function (sign-in, security tokens, load balancing). These cannot be switched off; without them the site simply will not work.
- Functional / preferences — remember your choices (e.g., language, theme, dismissed banners) so you don't have to re-set them on every visit.
- Analytics — Google Analytics 4 tells us, in aggregate, which pages get read and where people drop off. It is the only optional category we use, it never feeds advertising, and it stays off until you accept it.
Analytics is opt-in everywhere, not only where the law requires it (EEA, UK, California): the Google Analytics tag is not even loaded until you choose "Accept analytics" in the banner, and Google Consent Mode v2 stays denied for every storage type until then. There are no pre-ticked boxes, and "Reject" is exactly as prominent as "Accept". You can change your mind at any time from Cookie preferences in the footer or the button in Section 7; a decision is remembered for 12 months, after which we ask again.
4. First-party vs third-party
First-party cookies are set by nyzaevents.com or an event subdomain. Third-party cookies are set by external services we embed or rely on — e.g., Stripe's checkout iframe sets its own cookies that we cannot read.
5. Our cookie inventory
The cookies and similar storage items we set may vary as we ship new features. This inventory is a snapshot intended to be representative; the categories above bind.
| Name | Set by | Purpose | Category | Duration |
|---|---|---|---|---|
| __Secure-next-auth.session-token | Nyza Events | Keeps you signed in | Strictly necessary | 30 days |
| __Host-next-auth.csrf-token | Nyza Events | Protects against cross-site request forgery | Strictly necessary | Session |
| __Secure-next-auth.callback-url | Nyza Events | Returns you to the right page after sign-in | Strictly necessary | Session |
| nyza-theme | Nyza Events | Remembers light/dark/system theme | Functional | 1 year |
| nyza-locale | Nyza Events | Remembers your language and time zone choice | Functional | 1 year |
| nyza-events:cookie-consent | Nyza Events (local storage) | Remembers whether you accepted or rejected analytics, so we do not ask on every visit | Strictly necessary | 12 months |
| _ga, _ga_<stream-id> | Google Analytics 4 (third-party) | Distinguishes visitors and sessions for aggregate usage statistics — set only after you accept analytics | Analytics (opt-in) | 2 years |
| __stripe_mid, __stripe_sid | Stripe (third-party) | Payment security & fraud prevention on checkout pages | Strictly necessary | 1 year / 30 minutes |
| sentry-trace, baggage | Sentry (third-party) | Distributed-tracing headers for error reporting | Strictly necessary | Session (request scope) |
6. What we do not do
- We do not set third-party advertising cookies (no Google Ads, Facebook Pixel, TikTok Pixel, or equivalents).
- We do not run cross-site behavioral tracking.
- We do not sell or share data through cookies in a way that triggers CCPA "Do Not Sell or Share" obligations.
- We do not use device fingerprinting to identify you across browsers.
7. How to manage cookies
The fastest route is the button below, or Cookie preferences in the site footer — either opens the same panel, shows exactly what each category does, and takes effect immediately. Withdrawing analytics also deletes the Google Analytics cookies already on your device.
You can also control or delete cookies through your browser settings. Most browsers also let you block third-party cookies, refuse cookies from specific sites, or browse in a private/incognito mode. Helpful links:
If you block strictly-necessary cookies, parts of the Service — including sign-in — will not work.
8. Do Not Track & Global Privacy Control
We respect the Global Privacy Control (GPC) signal as a binding opt-out. When your browser sends it we do not show the banner at all: analytics stays off, any Google Analytics cookies already on your device are deleted, and we tell you on screen that the signal was honoured. It also counts as an opt-out of any sale or sharing of personal information for cross-context behavioral advertising — even though, as noted in Section 6, we do not engage in such sale or sharing. Because there is no consensus industry standard, we currently do not respond to browser "Do Not Track" (DNT) headers separately from GPC.
9. Changes to this Cookie Policy
We may update this Cookie Policy as we add or remove tools. The "Last updated" date at the top of the page reflects the most recent change. If we add a cookie that requires consent under applicable law, we will surface that change before the cookie is set.
10. Contact
Questions about how Nyza Events uses cookies? Email legal@nyzaevents.com.
Questions? Email legal@nyzaevents.com.
See also: Terms of Service · Privacy Policy · Acceptable Use · Refund Policy · DPA · California Notice