Legal

Cookie policy

One cookie, only after you sign in, and no third party ever hears from you.

Version 2 · last updated 13 Sept 2026

1 The short version

Rare for a cookie page: there is genuinely almost nothing to tell you.

1.1 Browsing this site sets no cookies at all. Read the rules, the store and this page, and nothing is stored on your device.
1.2 One cookie is set when you sign in, because that is the only way to keep you signed in from one page to the next.
1.3 No analytics, no advertising, no tracking pixels, no social media embeds, no third-party fonts or scripts.
1.4 Nothing on this site talks to another company while you read it. Not one request leaves our server.
1.5 That is why the notice has a single "I agree" button and no "accept all" or "reject" choice — there is no optional tracking to switch on or off.

What it is called, what is in it, and when it appears.

2.1 Name: zap.sid, or __Host-zap.sid over HTTPS.
2.2 When: the moment you sign in with Discord, or submit a form. Never before that.
2.3 What is in it: a long random number and nothing else. Your name, your purchases and your coins live in our database, matched to that number.
2.4 Flags: HttpOnly so no script on the page can read it, SameSite=Lax so another site cannot make your browser send it, and Secure so it only travels over HTTPS.
2.5 How long: it expires after a day of not being used, and is deleted outright after 30 days, when you sign out, or when you use "sign out everywhere" on your security page.
2.6 Purpose: keeping you signed in, and stopping cross-site request forgery. Both are what the law calls strictly necessary, which is why they need no consent.

Your browser remembers that you pressed "I agree" on the notice at the bottom of the screen.

3.1 A single value, zap.notice, is kept in your browser's local storage when you press "I agree" on the cookie notice.
3.2 It exists so the notice does not reappear on every page. It is never sent to our server and we cannot read it.
3.3 Clearing your browsing data removes it, and the notice simply shows once more.

Worth stating plainly, because most sites in this corner of the internet do all of it.

4.1 No Google Analytics, Plausible, Fathom or any other analytics.
4.2 No advertising, no retargeting, no conversion pixels from Meta, TikTok or anyone else.
4.3 No fingerprinting, no session recording, no heatmaps.
4.4 No fonts, icons or scripts loaded from a CDN — everything is served from this domain, so no other company ever learns you visited.
4.5 We do not sell, rent or share data with anybody for marketing. There is nothing to sell.

Only when you deliberately do something that needs them, and never while you are just reading.

5.1 Signing in sends you to Discord, on purpose, because that is how signing in with Discord works. Discord's own privacy policy applies while you are on their page.
5.2 Paying sends you to our payment provider's hosted checkout. They handle your card details; those never touch our server.
5.3 Your Discord avatar is loaded from Discord's image servers once you are signed in, so your browser tells them it fetched a picture. Signed out, that never happens.
5.4 Each of those is a page you chose to go to. None of them runs quietly in the background.

You can refuse the lot, with one consequence.

6.1 Block cookies for this site in your browser settings and everything public still works — the rules, the controls, the store, this page.
6.2 The only thing that will not work is signing in, because the cookie is what remembers that you did.
6.3 Sign out on your account page to delete it immediately, or use "sign out everywhere" to end every session on every device.
6.4 Ask us for a copy of everything we hold on you from your account security page, as a spreadsheet, any time.
6.5 Questions, or you think something here is wrong? Open a ticket and a person will answer it.

If a point here does not cover your situation, ask before you act. A question in Discord takes a minute; an appeal takes a lot longer.

Open a ticket Ask in Discord