Cookie Policy

Last updated: 2026-08-03

These documents are working drafts pending review by counsel.

The player site sets exactly the cookies below — all first-party, each with one job. There are no advertising or analytics cookies.

cas_player

Keeps you signed in: a signed session token, unreadable to scripts (HttpOnly). Deleted when you sign out; a stolen copy can be revoked server-side.

cas_dev

A random per-browser identifier used to spot many accounts created from the same browser (anti-fraud). Only a hash of it ever leaves the server, and nothing is refused for lacking it.

cas_tgdev

Ties a Telegram sign-in to the browser that started it, so a forwarded login link cannot complete somewhere else. Exists only for the duration of one sign-in.

NEXT_LOCALE

Remembers the language you picked in the header, so the next visit opens in it.

Other browser storage

Sign-in and partner links also need the browser to remember a little between page loads. These are not cookies: the browser attaches them to no request — the page reads them back itself, and only when it needs them.

cas.oauth

Holds a Google or X sign-in you have started — which provider it was, and the one-time value that identifies the attempt — so the page they return you to can finish it and refuses anything this browser did not start. Lives in sessionStorage: it dies with the tab, or after 10 minutes.

cas.tgpending.*

Holds a Telegram sign-in you have started, so leaving for the Telegram app — or a reload while you are away in it — does not lose the confirmation half-way. sessionStorage, this tab only.

cas.invite

The partner code from an invite link, so registering days after following it is still credited to whoever shared it. localStorage; erased as soon as it has been used for one registration.

If you block cookies

You can browse the lobby without any of these, but signing in requires the session cookie — without it there is no way to keep you signed in.