Cookie Policy
Last updated
October 21, 2026
In short
xtri.be sets the cookies it needs to work: sign-in, cart and checkout. It also sets two first-party cookies that record which link brought you here, so we can tell which links lead to sign-ups and purchases: xt_src, the source code of the link, and xt_vid, a random id for your browser. We use no advertising cookies, no third-party analytics and no tracking pixels, and we do not sell this data or share it with ad networks. If your browser sends Global Privacy Control, we do not set those two cookies (see Tracking and analytics). The chat window sets no cookies either, but it keeps a little data in your browser’s local storage (see Website chat). The xTribe iPhone app uses no cookies.
What cookies are
Cookies are small files a website saves in your browser. Ours keep you signed in, remember your cart and payment while you check out, and remember which link brought you here.
Cookies we set
The nine cookies below are set by xtri.be itself. All are secure (sent only over encrypted connections). All but xt_ref are httpOnly (scripts on the page cannot read them). The first seven, xt_auth to xt_ref, are needed for sign-in, checkout and invites. xt_vid and xt_src are not: they only measure which links bring people here, and the site works the same without them. xt_auth lasts as long as your sign-in (up to three days), xt_kiosk lasts 30 minutes, xt_ref and xt_src last 30 days, xt_vid lasts 13 months, and the rest last about a day or end when checkout finishes.
xt_auth
Keeps you signed in.
xt_sid
Identifies your visit and your cart session.
xt_cart
Holds your cart.
xt_pi
Tracks a payment that is in progress.
xt_pl
Tracks a payment link that you are paying.
xt_kiosk
Set when a membership purchase starts from the kiosk in the space.
xt_ref
Set only when you open a friend’s invite link and choose to claim it or book a tour. It remembers the invite code so the discount is applied when you join. It holds the code and no personal details.
xt_vid
A random id for this browser, kept for 13 months, so a later purchase, booking, tour or sign-up can be tied to the visit that led to it. It holds no name, email or phone number, but it is a lasting identifier, so you can block or delete it at any time. It is first-party: it goes only to xtri.be and to Entropy1, the platform that runs xTribe, and never to an ad network. It is not set when your browser sends Global Privacy Control.
xt_src
Set when you open a page from a link that carries a source code. It remembers that code for 30 days so the purchase can be credited to the link. It holds the code and no personal details. Offer links under /o/ do not set it, and neither does a browser that sends Global Privacy Control.
Browser session storage
Apart from cookies, the site uses your browser’s session storage for two things: your tour choices while you sign in, and whether you acknowledged the space rules for a booking. The browser clears it when you close the tab.
Stripe
On the checkout and payment pages, Stripe’s script sets its own cookies for fraud prevention and payment security, such as __stripe_mid and __stripe_sid. Stripe controls these cookies, and Stripe’s own policies govern them.
Website chat
The chat window at the bottom right is provided by OpenDesk, which Entropy1 hosts on entropy88.com. It sets no cookies. It saves one item in your browser’s local storage, named od_widget_ followed by the chat’s key, that holds an anonymous visitor token so your conversation is still there when you come back. If you are signed in, xtri.be also saves an item named xt_chat_user, the id of your account, so that signing out or switching accounts clears the visitor token. The visitor token stays until you delete the site’s data in your browser; if you were signed in, signing out clears both items on the next page you open. The chat window is not loaded on the membership sign-up link that the in-space kiosk gives you.
Tracking and analytics
We use no advertising cookies, no third-party analytics and no tracking pixels. Fonts are served from xtri.be itself, not loaded from Google when you view a page. The only measurement is our own, through xt_vid and xt_src. When you open a page from a link that carries a source code, the site tells Entropy1, our platform, the code, the page (without its query string), the website you came from (its address only) and your random visitor id. Entropy1 keeps the code, the visitor id, the page, the referring website’s host and a device type (iPhone, Android, desktop or other) worked out from your browser. It does not keep your IP address or your browser’s user-agent text with these records. We use this only to see which links lead to sign-ups and purchases, and we do not sell it or share it with ad networks.
Global Privacy Control and Do Not Track
If your browser sends the Global Privacy Control signal (Sec-GPC: 1), we do not set xt_vid or xt_src, we remove them if they are already in your browser, we record no visit, and we send no visitor id or source code with a purchase, booking, tour or sign-in. The cookies the site needs to work are still set. We do not respond to the older Do Not Track signal.
In the app
The app uses no cookies. It stores your sign-in token in the iPhone Keychain and, once you turn on notifications, a push token so we can send them. Stripe’s payment sheet handles payments in the app.
Managing cookies
You can block or delete cookies in your browser settings. If you block the necessary ones, sign-in and checkout will not work.
Changes and questions
If we add other analytics or advertising tools, we will update this policy and ask for your consent where required. Questions: help@xtri.be. For how we handle personal information, see our Privacy Policy at xtri.be/article/privacy.