Cookie-Richtlinie
Erste Fassung, veröffentlicht am 19. September 2026. Sie wird derzeit von unseren Rechtsberatern geprüft und kann sich noch ändern.Dieses Dokument ist vorerst nur auf Englisch veröffentlicht. Eine deutsche Fassung wird hier veröffentlicht.Before you read any further
This policy was first published on 19 September 2026, and this is version 1.2. It was read against Belgian and EU law on 24 September 2026 by our own legal function -- we have no outside counsel -- and this version makes every change that reading required. Section 2, which names each item we store, was rewritten in version 1.2, which takes effect on 17 November 2026, and has not yet been read against the law in the same way.
The short version: we store almost nothing on your device, none of it needs your consent, and that is why you are not being shown a cookie banner.
1. What this covers
This policy covers anything we store on, or read from, your device when you use our sites: cookies, and the browser storage that works like them. The law treats both the same way. We may store or read something without asking you only where it is strictly necessary to provide what you asked for; anything else needs your consent first.
2. What we store
Everything below is first party unless we say otherwise: it is set by our own sites, cannot be read by scripts where it is a cookie, is sent only over a secure connection, and is not sent to other sites. Each item is strictly necessary for something you asked for, or records a choice you made yourself.
Your Bicyr account, on every bicyr.com site:
— __Secure-better-auth.session_token keeps you signed in to your Bicyr account. It lasts thirty days.
— A known-device cookie recognises a device you have signed in from before, so we can protect your account. It lasts ninety days.
— ami_passkey_prompt remembers that you chose not to add a passkey for now. It lasts six months.
— ami_apple_new_account completes a choice you make while signing in with Apple. It lasts ten minutes.
— A short sign-in cookie on bicyr.com itself, set only after you are signed in, keeps your list of Bicyr products available if our account service is briefly unreachable. It lasts fifteen minutes, is renewed while you browse, records only which products you can open, and ends when you sign out.
Bicyr Cangor, at cangor.bicyr.com:
— cgr_session keeps you signed in to Bicyr Cangor. It lasts fifteen minutes and is renewed while you use it.
— cgr_operator, cgr_operator_flow and cgr_member_flow complete a sign-in. They last ten minutes at most.
— cgr_lang remembers the language you chose on the public site. It is set only when you pick a language yourself, and lasts one year.
— cgr_cart holds your cart and the tickets held for you while you check out. It lasts twenty-four hours.
— cgr_guest opens the invitation a personal invitation link points at. It lasts four hours and contains no name, e-mail or other detail about you.
— cgr_ticket_cashless opens your ticket’s cashless pages. It lasts twelve hours.
— cgr_site_pass lets you back into an event page its organiser protected with a password. It lasts thirty days.
— cgr_payout_grant, cgr-connecting-workspace and cgr_view_as complete security steps organisers take, such as confirming where payouts go. They last between two minutes and one hour.
— __cfwaitingroom keeps your place in a queue, when an organiser’s sale uses one. It lasts thirty minutes at most.
Payments and protection, from companies that work for us:
— Stripe, which processes payments, sets __stripe_mid and __stripe_sid on payment pages only, to process the payment and prevent fraud. They last one year and thirty minutes. Stripe’s script loads on those pages and on no other.
— Cloudflare Turnstile checks that a form is sent by a person rather than a program. It sets no cookie.
— A live stream from YouTube, Vimeo, Twitch or another platform loads only when you press Watch. Until then nothing reaches that platform; once you press it, the platform’s own cookies apply.
Your browser’s own storage keeps the choices you make, such as your language, light or dark appearance and how a page is laid out; drafts you have not yet sent; and, for staff at an event, the work they do offline until it is synced. It stays until it is sent, until you sign out, or until you clear it.
That is all. Our protection against abuse and overload is otherwise counted on our servers, not stored on your device.
3. What we do not store
— No analytics cookie, and in fact no analytics or error-tracking script of any kind anywhere on our sites.
— No advertising or marketing cookie, no tracking pixel and no tag manager.
— No identifier that follows you to other sites, and no fingerprinting.
— No tracking in our e-mail: our messages contain no images, no web fonts and no tracking pixel, and the build refuses to include one.
Where a page offers content from another company, such as a map, we intend that nothing reaches that company until you choose to load it. One map component in our component library would load map tiles as soon as it is rendered, and we are checking every place a map can appear before any of them is used on a page the public sees.
4. Why there is no cookie banner
We do not show a cookie banner because we store nothing that needs your consent. The absence is deliberate rather than an oversight: a banner asking your consent for nothing would be misleading, and so would a preferences panel with nothing in it to prefer.
If we ever add a cookie, a script or an embedded item that is not strictly necessary, we will ask for your consent before it is set, and this policy will list it. We are considering measurement tools that set no cookie at all; if we adopt one, we will describe it here, and we will check that it really is cookieless in the configuration we run rather than taking the word for it.
5. Managing what is stored, and contacting us
You can delete cookies and browser storage in your browser at any time. Deleting the sign-in cookie signs you out; deleting the display preference returns the appearance to your system setting; blocking the strictly necessary ones will stop you signing in and stop invitation links opening.
The platform is operated by Pilarres EOOD ("ПИЛАРРЕС" ЕООД), a single-member limited liability company entered in the Bulgarian Commercial Register under ЕИК (UIC) 208702712, VAT number BG208702712, with its registered office at гр. Пловдив 4000, р-н Централен, ул. 6-ти Септември № 152, Легис център, офис 3-8Б (ul. 6-ti Septemvri No. 152, Legis tsentar, ofis 3-8B, 4000 Plovdiv, Bulgaria). Telephone +32 485 02 94 23. E-mail info@bicyr.com.
We have not yet determined whether a Bulgarian company selling to Belgian consumers also needs an establishment or a representative in Belgium. If it does, we will publish a new version of this document and say what changed.
Changes to this policy are published here with their version and date. Where a change adds something that needs your consent, we ask for it before it is set.
Version cookies-1.2, gültig ab 2026-11-17.