This explains what Gain Arcade stores in your browser, what each thing is for, and how long it lasts. It covers cookies and browser storage together, because from your side they are the same question.

The list below is the whole of it. If something is not here, we do not set it.

These cannot be switched off without breaking sign-in or checkout.

• A session cookie set by our authentication provider, which keeps you signed in between pages. It is named after the project and ends in auth-token. It lasts for the length of your session and is refreshed while you stay signed in.
• A consent record, storing which of the choices below you made and when, so you are not asked again on every page. It is kept until you change it or clear your browser.

Cross-site request forgery protection is handled by the framework as part of how form submissions are validated. It does not involve a separate cookie you can see or refuse.

Your cart is kept in your browser's local storage under the name gainarcade.cart.v1, so a refresh or an accidental back button does not lose it.

It stays in your browser. It is not sent to us until you go to checkout, and it is not readable by any other site.

Clearing your browser storage empties your cart.

If you arrive through a referral link, we set a cookie named ga_ref containing the referral code from that link. It lasts 30 days.

It exists so that if you sign up later, the person who referred you is credited. It is read once, when an account is created, and deleted at that point.

It identifies the referral code, not you. We do not use it to build a profile, and it is not shared with anybody.

Thirty days is deliberate: long enough that somebody can follow a link, look around for a week and come back, and short enough that a shared computer does not attribute a stranger's signup months later.

When you reach checkout, our payment provider may set its own cookie to detect payment fraud. This is required in order to accept card payments, and the provider sets it directly rather than through us.

What that cookie contains and how long it lasts is determined by the payment provider, and is covered by their own policy rather than this one.

No payment provider cookie is set unless you reach checkout.

No advertising cookies. No cross-site tracking pixels. No third-party analytics.

We do not load Google Analytics, Meta pixels, or any similar service. There is no measurement script on this site that identifies you.

If that changes, this policy changes first and the consent banner will ask you before anything is loaded.

The consent banner lets you accept or decline the non-essential categories. Strictly necessary storage cannot be declined, because sign-in and checkout do not work without it.

You can change your choice at any time, and clearing your browser data resets it.

Blocking all cookies in your browser will stop you signing in. That is a limitation of how sessions work, not a choice we have made.