Cookie Notice
Last updated: August 20, 2026
Cookies at STHO
We use a small set of first-party cookies that are strictly necessary to sign you in and keep your session secure. They are HttpOnly wherever they carry session material, they are never used for advertising or analytics, and we set no third-party cookies.
Because none of them are optional trackers, there is no consent pop-up to click. If we ever add optional cookies, we will ask you first.
Cookies we set
Every cookie below is first-party, set by thestho.com, and strictly necessary to a service you have asked for.
| Name | What it is for | Lifetime | Attributes |
|---|---|---|---|
access_token | Carries your authenticated API session. The value is a short-lived token that our server attaches to each API call for you, so it is never readable by scripts in the page. | 15 minutes | HttpOnly · Secure · SameSite=Strict · Path=/ |
refresh_token | Renews your session, so that a short-lived access token does not sign you out every quarter of an hour. | 30 days | HttpOnly · Secure · SameSite=Strict · Path=/ |
session_roles | A routing hint recording which areas your account can open (artist, venue, admin), so pages redirect correctly without an extra round trip. It is never treated as proof of permission: every request is authorised against the access token. | 30 days | HttpOnly · Secure · SameSite=Strict · Path=/ |
active_artist_id | Remembers which artist profile you are working in when your account manages more than one. It holds a profile number, never a credential, and is deliberately readable by the page so the app can update it when you switch profile. | Until you close your browser | Secure · SameSite=Strict · Path=/ |
In production the three session cookies carry the __Host- name prefix (__Host-access_token, __Host-refresh_token, __Host-session_roles). The prefix makes your browser enforce Secure, Path=/ and no Domain attribute, which pins the cookies to this exact site so that no other subdomain can read or overwrite them.
The Secure attribute is set whenever the site is served over https, which is always the case in production; local development runs over plain http, where a Secure cookie would be dropped, and the __Host- prefix is not used there for the same reason.
Your language is currently resolved on the server and no language cookie is set. If per-account language persistence ships later, its cookie will be strictly necessary and will be listed here.
Browser storage
A few preferences and safety timers are kept in your browser's local and session storage rather than in cookies. Unlike cookies, this information is not attached to requests: it stays on your device until it is cleared.
| Key | What it is for | Stored in | Lifetime |
|---|---|---|---|
stho-public-theme | The light or dark theme you chose on the public site. | localStorage | Until you clear it |
admin_selected_country | The country an administrator has selected as their working scope. | localStorage | Until you clear it |
otp_sent_at_… / email_verification_sent_at_… | Anti-abuse timers, so that a phone or email verification code cannot be re-sent more than once a minute. | sessionStorage | Until you close the tab |
stho_ios_recovery_reloaded | A one-shot guard so that a failed script load reloads the page once instead of looping. | sessionStorage | Until you close the tab |
Error monitoring
We use Sentry, as our processor, to capture crashes and errors so that we can fix them. When something goes wrong, an error report — the fault itself, the page it happened on and technical details about your browser — is sent to Sentry so that we can diagnose it.
Sentry's session replay feature is not enabled: no recording or reconstruction of your session is made, and error monitoring stores nothing in your browser's cookies or storage. Before a report leaves your browser we strip the credential-bearing parts of it — session cookies and authorisation headers — and Sentry's default collection of personal information is switched off.
We use these reports only to diagnose faults, never for advertising, profiling or audience measurement, and they are deleted on Sentry's retention schedule. You can object to this processing at any time; see "Your rights" in the Privacy Policy.
Third-party services
We set no third-party cookies, and we embed no advertising, social media or audience-measurement trackers.
Address autocomplete uses Google Maps Platform. When you type an address, the text you type is sent to Google so that it can suggest completions. The request is made by our server rather than by your browser, so Google receives the address fragment but not your IP address, and it sets no cookies on this site. If our server has no Google API key configured, the app falls back to calling Google directly from your browser; in that case Google also receives your IP address.
Why there is no cookie banner
European rules require your consent before anything that is not strictly necessary is stored on your device. Every cookie in the table above is strictly necessary — signing in and session security — as are the preference and anti-abuse entries in browser storage, which exist only because you asked for them. So there is no banner to click.
We set no advertising, cross-site tracking or audience-measurement technologies of any kind, and we never sell or share your data for such purposes.
That is a commitment, not an accident: introducing any non-essential cookie or tracker requires a prior-consent mechanism and an update to this notice, and that requirement is enforced as a checklist item on every change we ship.
The mobile app
The STHO mobile app sets no cookies. Session tokens are held in the operating system's secure keystore, and no advertising identifier is read.
Questions
For anything about this notice, or about how we handle your data:
Email: privacy@thestho.com
Our Privacy Policy explains what we collect, why, and what rights you have.