Cookies
This site sets no cookie. Its one script remembers whether you chose light or dark, in your browser's local storage, and stores nothing else. The table above covers the webshop and the dashboards, not this page.
The cookies the rest of the product sets
The table below covers the buyer webshop, the organizer dashboard and the operational surfaces, so one page answers the question for the whole product. Each cookie is set by the surface named, and none of them is an advertising or analytics cookie.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
| nighthall_session | Organizer dashboard, control panel, webshop account area | Holds the signed-in session, encrypted. Without it nobody is signed in. | 30 days |
| nighthall_signin | Sign-in on the dashboard, the control panel and the webshop | Holds a sign-in that is in progress, so the identity provider can send the person back to the right place. | 10 minutes |
| nighthall-locale | Every NightHall surface that offers a language choice | Remembers an explicit language choice. It holds a language code and nothing else, and it is readable by the page. | One year |
| nighthall_order_email | Webshop order pages | Carries the address an order was placed with across the pages that follow, so the address never lands in a link. | 30 minutes |
| nighthall_ticket_pass | Webshop ticket page | Holds ticket codes the buyer has already been shown, so opening a page again is not a fresh code. It is scoped to one order. | 12 hours |
| nighthall_order_capability | Webshop order pages | Holds the capability from the link in the order confirmation. It is the key to that order and to no other. | 180 days |
| nighthall_preference_link | Webshop preference centre, reached from any message | Carries the one-link token from a message across the redirect that answers it, so the address proving the record is theirs never travels in the URL. | 1 day |
None of these needs consent. Each one exists so a page can do what the visitor asked for, and none of them measures, profiles, or advertises. The one that is not httpOnly is the language choice, because the page reads it to decide what language to render.
Every one of them is SameSite=Lax and Secure in production. All but one is httpOnly, so no script on the page can read it.
Why there is no consent banner here
German section 25 of the Telecommunications Digital Services Act and Dutch article 11.7a of the Telecommunications Act decide when a banner is owed. Both cover reading or writing information on terminal equipment. This site sets no cookie. Three scripts run here, and none of them sets one. The theme script stores light or dark in your browser's local storage, only after you choose it with the switch. The measurement script counts the visit and stores nothing: no cookie, no storage, and no identifier. It sends nothing at all when Do Not Track or Global Privacy Control is on. The contact and newsletter forms load a proof-of-work script that computes a challenge answer and stores nothing. That storage and that computation are strictly necessary for the setting and the function you asked for, which both provisions exempt. No consent is asked: a banner would falsely state that something needed asking about.
That reverses the moment something changes. A cookie, a tracker that stores or identifies you, or a script from another origin would bring this page into scope. This page would then need a banner and a refusal before anything is set. The position is recorded here so that it is a stated fact rather than an omission somebody notices later.
Removing a cookie
You can clear or block cookies in your browser settings. On this site that costs nothing, because nothing here depends on one. On the webshop and the dashboards it costs you your signed-in session and your language choice, and nothing else.