Cookie policy

1. What a cookie is, and which ones we use

A cookie is a small piece of text a website asks your browser to keep and send back on the next request. Local storage is the same idea, kept in your browser and never sent to a server.

Spawnfront uses only two kinds: strictly necessary cookies, without which logging in, signing up or a team's store cannot work, and preference cookies, which remember a choice you made about how the app looks or the language it speaks to you. A preference cookie is set only when you make the choice it remembers.

2. Cookies Spawnfront sets

These are set on Spawnfront's own address, never on a team's site, and are read only by Spawnfront. The staff console sets the same login, session and appearance cookies on its own address.

__Secure-session-token — Strictly necessary. Set by: Logging in, on Spawnfront and the staff console. Keeps you signed in. It holds a signed, encrypted token naming your account, and it is sent only to Spawnfront, never to a team's site. Lasts: 7 days, or until you log out.

__Host-authjs.csrf-token — Strictly necessary. Set by: Logging in or logging out. Proves a login came from Spawnfront's own form, so another website cannot sign you in or out. Lasts: Until you close the browser.

__Secure-authjs.callback-url — Strictly necessary. Set by: Logging in or logging out. Remembers the Spawnfront page to return you to after you log in. Lasts: Until you close the browser.

__Host-staff-sign-in — Strictly necessary. Set by: Logging in to a Spawnfront staff account on the staff console. Remembers, encrypted, that a staff account's password was right while its second factor is asked for. It is never set for any other account. Lasts: 5 minutes, or until the login finishes or you sign out.

support-mailbox-connect — Strictly necessary. Set by: Connecting the support mailbox on the staff console. Remembers, encrypted, which staff session started connecting the support mailbox while Google asks for consent. It is never set for any other account. Lasts: 10 minutes, or until the connection finishes.

age-screen — Strictly necessary. Set by: Signup's date-of-birth screen. Remembers that an answer under 13 was refused, so a retry shows the same answer. It holds the word “refused” and nothing else — no date, no account. Lasts: 1 year.

signup-birth-date — Strictly necessary. Set by: Signup's date-of-birth screen. Carries the date of birth you entered, encrypted, from the age screen to the moment your email is verified, when it is saved on your profile and the cookie is deleted. Lasts: 1 hour.

pending-gift — Strictly necessary. Set by: Following a gift link. Remembers the gift code you followed, encrypted, while you sign up or log in to use it. Lasts: 7 days, or until the code is used.

invite-continuation — Strictly necessary. Set by: Opening a team invitation. Remembers the invitation you opened, encrypted, while you sign up or log in to accept it. Lasts: Up to 7 days, never longer than the invitation.

discord-attempt — Strictly necessary. Set by: Continue with Discord. Ties a Discord sign-in to the browser that started it, so a sign-in link someone else started cannot finish in yours. Lasts: 10 minutes.

discord-signup — Strictly necessary. Set by: Signing up with Discord. Carries Discord's answer (your Discord id, username and verified email), encrypted, while you answer the date-of-birth screen. Lasts: 5 minutes.

discord-welcome — Strictly necessary. Set by: Signing up with Discord. Shows the one-time “Signed up with Discord” note on your Dashboard. It holds “1” and nothing about you. Lasts: 10 minutes, or until the note has shown.

discord-import — Strictly necessary. Set by: Importing game accounts from Discord. Carries the game accounts Discord suggested, encrypted, to your profile's Games page. Lasts: 5 minutes.

locale — Preference. Set by: Choosing a language from the account menu or on the log-in pages. Remembers the language you chose for Spawnfront in this browser. Lasts: 1 year.

theme_mode — Preference. Set by: The signed-in app's and the console's appearance settings. Remembers light or dark mode. Lasts: 7 days.

content_layout — Preference. Set by: The signed-in app's and the console's appearance settings. Remembers whether pages are centered or full width. Lasts: 7 days.

navbar_style — Preference. Set by: The signed-in app's and the console's appearance settings. Remembers whether the top bar scrolls with the page. Lasts: 7 days.

sidebar_variant — Preference. Set by: The signed-in app's and the console's appearance settings. Remembers the side menu's look. Lasts: 7 days.

sidebar_collapsible — Preference. Set by: The signed-in app's and the console's appearance settings. Remembers how the side menu collapses. Lasts: 7 days.

sidebar_state — Preference. Set by: Opening or closing the side menu. Remembers whether the side menu was open or closed. Lasts: 7 days.

3. Browser storage

spawnfront-cart:<site address> — Strictly necessary. Set by: Adding an item to a team's store, on that team's site. Remembers your cart on that site — the cart's id at Fourthwall and when you went to checkout — so it is still there on the next page. Each team's site keeps its own. Lasts: Until the cart is finished or forgotten, or you clear your browser's storage.

tournaments-seen-at:<team id> — Preference. Set by: A team admin's Tournaments page. Remembers when you last looked, so new tournament activity since then is marked. Lasts: Until you clear your browser's storage.

staff-passkey-from-another-device — Strictly necessary. Set by: Logging in to a Spawnfront staff account on the staff console with a passkey from another device. Remembers, for this tab only, that the passkey came from another device such as a phone, so the console can offer once to add a passkey on this one. It holds the figure 1 and nothing else. Lasts: Until the offer is answered or you close the tab.

staff-device-passkey-dismissed — Preference. Set by: Choosing Not now when the staff console offers to add a passkey on this device. Remembers that you said no, so this device is not asked again. It holds the figure 1 and nothing else. Lasts: Until you clear your browser's storage.

4. Third parties

Videos a team adds to its site play in YouTube's player from www.youtube-nocookie.com, YouTube's privacy-enhanced address. The player loads with the page today, and YouTube may store its own cookies or local storage in your browser under Google's privacy policy.

Twitch streams a team shows on its site, and the live stream window on a team's site, play in Twitch's own player. The player loads with the page today, and Twitch may set its own cookies under Twitch's privacy policy.

Checkout happens on the provider's own pages: Polar for the site subscription and gifts, Fourthwall for a team's store. Those pages are on their own addresses and set their own cookies under their own policies; Spawnfront neither sets nor reads them.

5. No advertising or analytics cookies

Spawnfront sets no advertising or analytics cookies, runs no tracking pixel and shares nothing from your browser with an advertiser. Our email is sent without open or click tracking.

6. Your choices

Every browser lets you see, block and delete cookies and local storage for a site. Blocking Spawnfront's strictly necessary cookies stops you logging in or signing up; deleting a preference cookie returns the app to its default look.

7. Changes and contact

We update this page in the same change that adds, removes or alters a cookie. The date at the top says which version is in force.

Write to support@spawnfront.com about anything on this page.