What this covers
“Cookies” here means cookies and everything that behaves like one: values stored in your browser’s local storage and session storage, and any tag or pixel loaded from another company. All three can identify a browser, so all three are listed.
This covers xex.to and the consoles and portals served from it. An operator running a programme on its own domain publishes its own notice; where it configures its own analytics or advertising tags, those are its responsibility and are covered in the last section.
The consent model
Nothing that is not strictly necessary loads before you decide. That is a property of how the site is built, not a policy statement: no analytics or advertising script element is created, and no request to an analytics or advertising host is made, until a consent decision exists.
- Before you decide: zero requests to any analytics or advertising host, zero scripts created, and no cookie set beyond the strictly necessary ones a signed-in session needs.
- Accept all: the purposes you accepted are enabled and their tags load.
- Reject non-essential: nothing loads, and the site works exactly the same. There is no cookie wall, no degraded mode and no repeated prompt.
- Choose: per-purpose control, with every optional purpose off until you turn it on.
Your decision is recorded and honoured on your return. You can change or withdraw it at any time from the Cookie preferences control in the site footer, on every page. Withdrawing does not affect what happened while consent was in force.
Strictly necessary — set without consent
These exist because the site cannot do what you asked without them: keep you signed in, know which programme you are looking at, avoid taking a payment twice, and remember that you already answered the consent question.
| Name | Kind | What it is for | Lifetime |
|---|---|---|---|
| xex-consent | Local storage · first party | Your consent decision itself. Without it you would be asked again on every page — which is why a consent record is itself strictly necessary. | Until you change it or clear your browser storage. |
| xex_member_token | Cookie · first party · HttpOnly, Secure, SameSite=Strict | Your member session for the programme you are signed in to. Set only after you sign in. | Expires with the session token it holds. |
| xex_member_ws | Cookie · first party · HttpOnly, Secure, SameSite=Strict | Which programme the active session belongs to, so the portal shows that programme's data and not another's. | Same as the session token. |
| xex_member_sessions | Cookie · first party · HttpOnly, Secure, SameSite=Strict | A map of the programmes you are signed in to, so one browser can hold more than one membership without signing out of the others. | Same as the session tokens it holds. |
| xex_link_token | Cookie · first party · HttpOnly, Secure, SameSite=Strict | A short-lived token held while you link an account to a programme. It authorises nothing on its own until you confirm the link. | Ten minutes, or until the link is confirmed. |
| xex_op_token | Cookie · first party · Secure, SameSite=Strict — written by the console's sign-in gate in the browser, so unlike the member cookies it is not HttpOnly | Your operator console session. Set only after an operator signs in. | One hour, then re-issued while you stay signed in. |
| xex_op_ws | Cookie · first party · HttpOnly, Secure, SameSite=Strict | Which workspace an operator is currently working in. | 30 days, or until you switch workspace. |
| xex_magiclink_email | Local storage · first party | The email address a sign-in link was sent to, so the link can be completed in the same browser. Removed once sign-in completes. | Until sign-in completes. |
| xex_central_redirect | Session storage · first party | Marks that a sign-in redirect is in flight, so returning from the identity provider is not mistaken for a fresh visit. | Until the browser tab is closed. |
| xex_buy_ref:… | Session storage · first party | The idempotency reference for one checkout attempt, keyed by package, payment rail and asset. It is what stops a reload creating a second invoice on the operator's payment account. | Until the browser tab is closed. |
| xex_buy_intent:… | Session storage · first party | The identifier of the payment attempt in flight, so a reload resumes the payment instructions instead of stranding a live intent you can no longer see. | Until the browser tab is closed. |
| xex.guide.seenTours | Local storage · first party | Which in-product tours you have already dismissed, so they are not shown again. | Until you clear your browser storage. |
Nothing in this table is used for analytics, profiling or advertising, and none of it is shared with a third party.
Optional — only after you consent
The analytics loader on this site is currently a stub. It records which tags would have fired for the consent you gave, and loads none of them. That means that today, even after accepting, no analytics or advertising request leaves your browser from this site. This section describes what will load when that work is completed, and it will be corrected if the plan changes.
| Purpose | What would load | Identifiers | Lifetime |
|---|---|---|---|
| analytics | Google Analytics 4, loaded from googletagmanager.com, with advertising signals denied by default. | _ga, _ga_<measurement id> | [[ To be supplied — analytics cookie lifetime once configured ]] |
| advertising | Nothing on this website. Advertising destinations exist only in the per-programme tracking configuration described below, and are the operator's. | — | — |
Where analytics is enabled, the events sent are limited to page views and a small set of product events (which plan was selected, that a workspace was created, that a programme page was viewed). No email address, member identifier or workspace identifier is sent.
What happens if you refuse
Nothing. Every page, every programme listing and every sign-in works identically with consent refused. There is no cookie wall on this site, no content held back, and no repeated prompting for a decision you already made.
Refusing does not remove the strictly necessary items above, because those are not consent-based: without them you could not stay signed in, and the site could not remember that you refused.
Changing or withdrawing your decision
Use the Cookie preferences control in the footer of any page. It reopens the banner with your current choices, and saving replaces the previous decision.
You can also clear site data in your browser, which removes every item in the first table including the consent record — after which you will be asked again.