Policies and updates # Cookie policy Effective 13 October 2026 You can play without any cookie at all. We set ours only when you sign in. Analytics cookies are set only outside the EEA, the UK and Switzerland, and we use no advertising cookies yet. The game keeps your name and settings in your browser, not on our server. Cards you have seen are kept in your browser too, and for online rooms our server also keeps that list for 7 days. ## 1. What cookies are A cookie is a small file a website asks your browser to keep and send back on your next visit. Browser storage is similar but stays on your device: the site's own scripts read it, and it is never sent to our server by itself. This policy lists both. The [privacy policy](https://truthordaregame.net/privacy) explains what we do with the data behind them. ## 2. Cookies we set We set three cookies, all for signing in. None of them tracks you on other sites. - **tod_session** keeps you signed in. It holds a random token that only means something to our server, and it lasts 30 days or until you log out. Your browser cannot read it from a page, and it is sent only to this site. - **tod_known** remembers that this browser has signed in to your account before, so someone guessing your password from elsewhere can't lock you out. It holds a signed, scrambled form of your email address, never the address itself, lasts a year, and is sent only to our sign-in pages. - **tod_oauth** is set only while you sign in with Google. It checks that the reply really comes from your own sign-in, and it lasts ten minutes. Because these are needed for the service you asked for, they do not need your consent. ## 3. Cookies other companies set - **Google Analytics** sets **_ga** and **_ga_** followed by an ID, which tell a new visit from a returning one. They last up to two years. In the EEA, the UK and Switzerland they are not set, and visits there are counted without cookies. - **Statsy** may set **statsy_vid** for the same reason, for up to a year. It does not load at all in the EEA, the UK or Switzerland. - **Google reCAPTCHA** loads only on the sign-up and sign-in pages. To tell people from bots it may set its own cookie, such as **_GRECAPTCHA**, which lasts up to six months. - **Cloudflare** carries all traffic to the site. Its analytics set no cookies. Its security checks may set a short-lived cookie, such as **__cf_bm**, when a visit looks automated. - **Advertising partners** will set cookies to show and measure ads once ads launch. We will list them here before then, and personalised ads will need your agreement. These companies decide how their own cookies work, under their own privacy policies. ## 4. What your browser keeps The game keeps these in your browser's local storage. They stay on your device until you clear them. - **tod-name** and **tod-avatar:** your player name and emoji, so you don't type them every time. - **tod-pid:** a random player ID, so a refresh puts you back in the same seat in a room. - **tod-host-**, **tod-seated-**, **tod-left-**, **tod-gate-**, **tod-cards-** and **tod-joined-** followed by a room code: whether you host that room, whether you took a seat in it, whether you chose to leave it, why the room last sent you back to its seat screen, how many cards you have played there, and whether your joining was already counted. These last only until you close the tab. - **tod-pnp-game:** the one-phone game in progress (players, whose turn, the card on the table), so a refresh doesn't end it. It lasts until you close the tab. - **tod-pro-interest:** that you tapped "I'm interested" for video and voice calls, so we don't ask again. - **tod-pnp-roster** and **tod-pnp-seen:** the names on your one-phone game, and the cards that phone has already dealt, kept 7 days so the next game doesn't repeat them. - **tod-default-deck**, **tod-drinks**, **tod-lang**, **tod-turn-alerts** and **tod-read-size:** your deck, drinking game, language, turn alert and text-size choices. - **tod-pwa-later** and **tod-pwa-installed:** whether you closed or used the "Add to home screen" banner. Separately, our server remembers which cards your browser has been dealt in online rooms for 7 days, filed under a scrambled version of your player ID. The privacy policy explains this. ## 5. Your choices You can block or delete cookies and browser storage in your browser's settings at any time. The game still works without them: you only lose being signed in and your saved settings, and a refresh may not put you back in your room seat. Blocking Google Analytics or Statsy does not change anything in the game. Most browsers and many extensions can block them for you. ## 6. Changes When we add or remove a cookie, we update this page and the date at the top. Questions go to [hello@truthordaregame.net](mailto:hello@truthordaregame.net). [Back to the game →](https://truthordaregame.net/)