Cookies

Cookie and Tracker Notice

This page explains what we store on your device and what calls we make to third parties from your browser. We use the word "cookie" below to cover cookies, localStorage, sessionStorage, and any similar local-storage mechanism.

1. Strictly necessary (no consent required)

These are essential to log you in and to keep the Service working. Without them the Service does not function. Under the ePrivacy Directive, strictly necessary storage does not require consent.

| Name | Where stored | Purpose | Retention | |------|--------------|---------|-----------| | session_token | localStorage | Holds the current authentication token so you stay signed in across page loads. The token itself is HMAC-hashed server-side. | Deleted on sign-out; expires after 15 minutes of inactivity on the server side. | | locale | localStorage | Remembers your UI language choice. | Until you change it or clear site data. | | CSRF / anti-forgery tokens (if present) | Memory or short-lived cookie | Protect against cross-site request forgery on state-changing requests. | Per session. |

2. Functional preferences (opt-in, where used)

Any preference-style storage that is not strictly necessary is set only after you have consented. We do not currently use any such storage beyond the strictly-necessary list above. If that changes, this section will describe what and why.

3. Analytics and marketing (opt-in, where used)

We do not currently load any third-party analytics or advertising trackers. If we ever introduce any, they will be listed here with their purpose, the third party involved, the data they collect, and their retention, and they will load only after you have given consent.

4. Third-party requests

Browsers visiting our pages — authenticated or not — currently make no third-party requests. We do not load any analytics, tag manager, advertising, or session-replay script; we do not embed third-party widgets; we do not load remote fonts (every font in the UI is self-hosted via @fontsource); we do not make outbound API calls from the browser to any service we do not also operate. Because there is no non-essential storage and no third-party tracker, there is no consent banner — there is nothing to gate. If that ever changes, this section will list each third-party host, the data received by it, and the consent basis, and a banner will appear before any non-essential storage is set.

5. Managing your choices

  • Sign out from your account settings to clear your session storage immediately.
  • Use your browser's "clear site data" control to remove all storage set by this site.
  • If, in future, we introduce any non-essential storage, a persistent "Cookie settings" link will be added to the footer so you can review and change your consent choices at any time.

6. Changes

This notice is kept in sync with the actual cookies set by the Service. If you find drift between what this page describes and what your browser sees, email privacy@playbymail.games.