pulup

Cookie Policy

A comprehensive breakdown of how PulUp uses cookies and similar tracking technologies. Complete transparency about what data we collect and why.

last updated: 1 July 2026

Quick Summary

Currently, PulUp uses minimal cookies focused on essential functionality. Here's what's active:

Essential
1 cookie
Session management
Analytics
0 cookies
Cookieless (Umami)
Marketing
0 cookies
Not used

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, keep you logged in, and understand how you use the platform.

PulUp uses cookies responsibly and only when necessary to provide core functionality or improve your experience. We believe in data minimalism - collecting only what's essential.

2. Cookies We Currently Use

As of now, PulUp uses only one essential cookie to maintain your authenticated session. No tracking, no analytics, no marketing pixels.

Essential Cookies

Required for core platform functionality. These cannot be disabled.

authjs.session-token
First-partyRequired

Stores your authentication session to keep you logged in as you navigate PulUp. This cookie is essential for accessing your account and creating events.

DURATION: 30 days

Analytics: We use Umami, a privacy-first analytics tool that is cookieless — it sets no cookies and collects no personal data, so it requires no consent.

Payments: When you make a purchase, you are redirected to Stripe's secure hosted checkout. Stripe sets its own cookies on Stripe's domain to process the payment and prevent fraud, governed by Stripe's Privacy Policy. These are not first-party PulUp cookies.

3. Managing Your Cookie Preferences

You can control the essential cookie through your browser settings:

  • Block all cookies (note: this will prevent you from logging into PulUp)
  • Delete existing cookies from your device
  • Enable "Do Not Track" signals (we respect these settings)

4. Technical Implementation

For transparency, here's how our authentication cookie works:

Cookie Name:authjs.session-token
Set By:Auth.js (PulUp authentication)
Storage Type:HTTP Cookie (accessible to client & server)
SameSite Policy:Lax (CSRF protection)
Secure Flag:True in production (HTTPS only)
HttpOnly:False (required for API authentication)
Expiration:30 days
Note on HttpOnly: While most session cookies use the httpOnly flag for security, our authentication system requires client-side access to attach tokens to API requests. This is a standard practice for modern SPAs (Single Page Applications) and doesn't compromise security when combined with HTTPS and SameSite policies.

5. Legal Basis (GDPR & ePrivacy)

Under the General Data Protection Regulation (GDPR) and ePrivacy Directive, here's our legal basis for cookie usage:

Essential Cookies (authjs.session-token)

Legitimate Interest + Performance of Contract

Required to authenticate users and provide the core service. GDPR Article 6(1)(b) and ePrivacy Directive Recital 66 allow essential cookies without explicit consent.

Data Controller
DraVan Technologies SARL-S, Luxembourg
Cookie Set By
PulUp via Auth.js — the essential session cookie is first-party and not shared with third parties

6. Updates to This Policy

We'll update this Cookie Policy whenever we introduce new cookies or change how we use them. Major changes will be communicated through:

  • Email notification to registered users
  • In-app banner or notification
  • Updated "Last modified" date at the top of this page
Questions or concerns? Contact us anytime: