Last updated: 10 August 2026
Cookies and similar technologies (local storage, session storage) let the tour work and — only with your consent — help us understand how the experience is used. Strictly necessary items are always active; everything else is off until you accept it in the banner. You can change your mind at any time via “Cookie settings” in the footer.
| Name | Category | Purpose | Lifetime |
|---|---|---|---|
| pt_session | Strictly necessary | Identifies your listener session so your tour access, saved progress and free-demo progress (including whether the demo has already been used) are restored. | 12 months (HttpOnly, Secure) |
| pt_consent | Strictly necessary | Stores your cookie choices so we can honour them on later visits. | 12 months |
| pt-theme (local storage) | Strictly necessary | Remembers light/dark appearance. | Until cleared |
| sb-…-auth-token (local storage) | Strictly necessary | Set only for staff signing in to the private admin area: keeps the authenticated session so the admin stays signed in. It is not set for visitors taking a tour. | Until sign-out or cleared |
| pt_open_buy / pt_open_demo / pt_highlight_buy (session storage) | Strictly necessary | Remembers, for the current tab only, that you followed a link that should open the ticket dialog or start the demo. | Until the tab is closed |
| Player state keys (session storage) | Strictly necessary | Keeps the current stop, volume and playback speed while the tab is open. | Until the tab is closed |
| Essential session records (server-side) | Strictly necessary | Tour and session state, stops reached or completed, audio start/completion status, listening time, saved position and speed, plus security and error logs needed to deliver and restore the tour. | 24 months after your last activity |
| Pop-up display state (server-side) | Strictly necessary | Records that a pop-up or the mid-tour question has already been displayed in your tour, so it is not shown to you again. | 24 months after your last activity |
| Consent audit record (server-side) | Strictly necessary | Stores your cookie choices (including “no decision yet”) as a compliance record, so we can demonstrate which preferences applied to your visit. | 24 months |
| Behavioural analytics events (server-side) | Analytics — consent | Optional detailed interaction data: how you interact with pop-ups and the interface, autoplay diagnostics, listening behaviour and the text of any feedback you submit, used to improve the tours. | 12 months |
| GPS route points (server-side) | Analytics — consent | The coordinates you walked during a tour, stored as a route history for route analysis. Without this consent your live location is used only to run GPS mode and is not retained as a route history. | 12 months |
| pt_first_attrib / pt_last_attrib | Marketing — consent | Remembers the campaign, ad or partner link that brought you here (first- and last-touch attribution). | 12 months |
Loading the app, maps, routes, fonts and payment pages means your IP address and technical request information reach our hosting and infrastructure providers (Lovable and Cloudflare), our database and storage provider (Supabase), OpenStreetMap tile servers, FOSSGIS-operated routing services (Valhalla, OSRM) and BRouter, Cloudflare R2 for audio and image files, Google Fonts and UNPKG, Resend for ticket and access-code emails, our hosting platform's built-in email infrastructure (Lovable Emails) for account and sign-in emails, and Stripe for payments. If you use the in-app help link, your message is handled by WhatsApp (Meta) under its own terms. Stripe may set its own cookies on its hosted checkout page. None of these providers set advertising cookies through our app. See the Privacy Policy for details, retention and transfer safeguards.
Use “Cookie settings” below, or clear cookies in your browser. Analytics and marketing categories are off until you switch them on. Blocking strictly necessary cookies will prevent tours from loading. Withdrawing marketing consent deletes the attribution cookies immediately; withdrawing analytics consent stops any further behavioural analytics and GPS route history from being recorded. Withdrawal does not affect processing carried out before you changed your preferences.