Cookie Policy

The short version

This site sets one cookie of its own, and it only appears after you sign in. Everything else we keep in your browser is stored in localStorage, not in cookies, and none of it is used for advertising.

There is no cookie banner on this site. That is not an oversight and it is not us being clever with the rules. We do not run Google Analytics, we do not run a Meta pixel, there is no tag manager, no session replay and no fingerprinting library anywhere in the site's code. There is nothing to ask you to consent to that would change what you see.

Two things do go into your browser before you have done anything at all: an anonymous device id and a record of how you arrived. Both are described below in full. Neither contains your name or your email address, and neither is shared with anyone.

This page was last updated on 20 August 2026.

What a cookie is here, and what is not

A cookie is a small file a site asks your browser to store and send back with every request. localStorage is different: it also lives in your browser, but it is never sent anywhere automatically. Our own code has to read it and post it deliberately. Most of what we store is localStorage, so we have listed it here even though it is not, strictly speaking, a cookie. You almost certainly do not care about the distinction — you care what is on your machine and what it does.

We do not use sessionStorage at all.

The one cookie we set

The sign-in session cookie. Set only at the moment you sign in or create an account at /login. If you buy a seat as a guest and never make an account, this cookie is never set.

• Name: the default name used by our authentication library, better-auth.session_token. Over HTTPS your browser will show it with a __Secure- prefix.
• What it holds: a random session token. Not your name, not your email, not your password.
• What it does: keeps you signed in as you move between pages, so the portal knows which orders are yours.
• Lifetime: 30 days. It refreshes on use, so an active session keeps rolling forward.
• Flags: httpOnly, so scripts on the page cannot read it, and SameSite=Lax, so it is not sent along with requests started by other sites.

This one is strictly necessary. If you block it, you cannot stay signed in. There is no version of an account area that works without it.

Alongside it, our authentication library keeps a short-lived cache of your session for up to five minutes, so that every page load does not hit the database. It holds the same information as the cookie above and no more.

Cookies Stripe sets when you pay

Card details are entered inside a frame served by Stripe, on Stripe's own domain. We never see, handle or store a card number. Stripe loads its own script on the checkout page and sets its own cookies, on its own domain, to detect fraud and to tell a real payment attempt from an automated one.

We do not set those cookies, we cannot read them, and we cannot switch them off — a payment page without fraud detection is not a payment page anyone should use. What Stripe does with them is governed by Stripe's own privacy policy, not ours.

The only other company that receives anything from us is Resend, which sends our emails. That happens on our server, after you have given us an email address. It does not involve your browser and it sets nothing on your machine.

What we store in localStorage

These six keys are the real picture. They persist until you clear your browser data — none of them expires on its own.

seismic.anon.v1 — a random device id in the form anon_ followed by a UUID. Created on your first page view. It lets us count how many distinct devices reached the pricing page versus how many reached checkout, without knowing who any of them are. It is not linked to a name and it is not shared with anyone.

seismic.attribution.v1 — a record of how you first found us, written on your very first visit and never overwritten afterwards. It holds any utm_source, utm_medium, utm_campaign, utm_content, utm_term or ref values in the address you arrived on, any gclid or fbclid identifier a link carried, the address of the site that referred you, the first page you landed on, and the time you arrived. It travels with your checkout, so we can tell which piece of writing or which link actually sells seats.

Be plain about what that is: it is a first-touch marketing record, and it is written before you interact with the page, with no consent step in front of it. It contains no name, no email and no browsing history beyond that one arrival. If that is not acceptable to you, clearing site data removes it, and the section below explains how.

seismic-cart — the offer ids of what you have put in your cart and which weekend you picked. No prices and no product names are stored; the server looks those up itself, so a modified cart cannot change what you are charged.

withseismic.order-token — the access token for your order. Treat this one seriously. It is a bearer credential: anyone who has it can open your order, and on the thank-you page and in the portal it can be used to add a purchase to the card you paid with. It is also in the address of your thank-you page, so do not paste that link into a public place, and be careful sharing a screen that has it on show. We strip it out of everything we record for analytics.

withseismic.purchase — a small summary of your last purchase (weekend, tier, total, add-ons and the time) so the thank-you page and the portal can show it without another round trip.

withseismic.progress — how far through the course you are, lesson by lesson. This one never leaves your device. We do not send it to the server and we cannot see it, which also means it does not follow you to a second computer.

What we do with the analytics id

The device id and the attribution record are used by our own analytics, running on our own servers. Nothing is sent to a third party.

We record a fixed list of thirteen things, and the server refuses anything else: a page view, an event page view, a seat added, the cart opened, checkout started, contact details submitted, payment succeeded, an upsell viewed, accepted or declined, a receipt viewed, the portal viewed, and a lead captured.

Each one carries the device id, the page path, the attribution record and, once you have given it to us at checkout or on a signup form, your email address. We say that plainly because it is the point at which anonymous stops being anonymous. Order access tokens and similar identifiers are stripped out of the recorded path before it is stored.

These events are sent in the background and we do not retry them. If your browser blocks them, nothing on the site breaks.

How to refuse or remove any of this

There is no settings panel on this site, because a panel with one switch on it would be theatre. Your browser already does the job better:

• Clear site data for this domain in your browser's settings. That removes the session cookie and all six localStorage keys. You will be signed out, your cart will empty and your saved order token will go — keep your order number and the email address you used, since the portal accepts those instead.
• Block cookies for this site. You will still be able to browse, read and buy. You will not be able to stay signed in.
• Use a private window. Everything above is discarded when you close it.
• Browser extensions that block trackers will not find much here, but blocking Stripe's script will stop the checkout page from working.

Our site does not currently read the Global Privacy Control signal. That is a factual statement about the code as it stands, not a position on the signal.

Changes, and how to ask

If we add a third-party tool that sets a cookie, this page changes before it ships, and if that tool does anything a reasonable person would object to, we will ask first rather than bury it here.

Questions about anything on this page, including a request to see or delete what we hold: doug@withseismic.com. For the wider picture of what we keep on our servers and for how long, see /legal/privacy(/legal/privacy). Our /legal/terms(/legal/terms) and /legal/refunds(/legal/refunds) cover the purchase itself.