The short version
We use the minimum local storage needed to make the game work, plus a single privacy-respecting analytics tool (Google Analytics 4 with anonymized IP) — only after you give consent. We don't track you across other sites. No advertising cookies. No marketing pixels.
What we store
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
ccf_active_session | localStorage | Your in-progress case (resume after closing tab) | 8 hours |
ccf_nickname | localStorage | Your leaderboard handle | Until you change it |
ccf_streak | localStorage | Daily case streak counter | Until you clear local data |
ccf_history_* | localStorage | Your past case results (for personal stats) | Until you clear local data |
ccf_daily_* | localStorage | Whether you solved today's case | Per-day, expires daily |
ccf_cookie_consent | localStorage | Remember that you've seen the cookie banner | 12 months |
sb-*-auth-token | localStorage | Supabase auth session (only if you sign in) | 30 days, refreshed automatically |
Third-party cookies
We use exactly one third-party analytics tool — Google Analytics 4 — and only after you accept the cookie banner. It uses Google's Consent Mode v2: until you click "Got it", the GA cookies do not store any analytics data.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga | Google Analytics | Distinguishes unique users (anonymized) | 2 years |
_ga_* | Google Analytics | Persists session state for GA4 property | 2 years |
We do not load Facebook Pixel, Hotjar, TikTok pixel, advertising networks, or any other third-party trackers. Google Ads features (ad_storage, ad_personalization, ad_user_data) are explicitly disabled in our GA configuration.
How to opt out
- Click "Essential only" on the cookie banner — analytics stays disabled.
- If you previously accepted, you can revoke by clearing localStorage for this domain (browser → DevTools → Application → Local Storage → delete
ccf_cookie_consent). The banner reappears next visit. - Use a browser extension like uBlock Origin or Privacy Badger to block GA entirely.
- Clear your browser's local storage for this domain — wipes everything we store.
- Sign out — removes the auth token.
- Use private/incognito mode — no data is persisted across sessions.
Changes
If we ever add a new tracker, we'll update this page and ask for fresh consent.