Cookie Policy

Cookies and similar technologies

Cookies are small records stored by the browser. We also use localStorage, sessionStorage, a service worker, and session identifiers to maintain features and choices.

Some records are necessary for the service; others are used only after consent. Cookies do not necessarily mean we know a person's name, but they may be personal data when linked to an account or device.

Current inventory

• session: first-party cookie, normally HttpOnly, used for authentication and security. Duration: until logout, revocation, or server-defined expiration.
• ptc_privacy_consent: first-party cookie indicating that a privacy choice exists. Maximum duration: 12 months.
• privacy_consent_id: technical backend cookie linking the consent record without exposing full preferences to the browser. Duration: according to server-record validity.
• invite_ref, invite_ref_captured_at, invite_ref_source_url, and invite_share_id: cookies or local storage used for campaign and invite attribution. Maximum browser duration: 30 days.
• predict-the-cup:privacy-consent:v1: localStorage containing policy versions, choice date, and accepted categories. It remains until withdrawal, browser clearing, or a version change.
• Local interface preferences: records for level popups, profile completion, and campaign reminders. They remain until browser clearing or replacement by the application.
• Push records: indicate activation and when the prompt was dismissed. The dismissed prompt uses a 7-day interval; the subscription remains until cancellation or expiration.
• Avatar and invite sessionStorage: prevents stale cache and repeated attempts in the current tab. It is removed when the tab session ends or the action completes.

Third-party technologies

• Vercel Analytics: loads only with Analytics consent and measures access and performance according to provider configuration.
• Microsoft Clarity: loads only with Analytics consent and may use identifiers such as _clck and _clsk, plus Microsoft-domain cookies, to relate sessions and interactions.
• YouTube privacy-enhanced mode: embedded videos use youtube-nocookie.com; after interaction, Google may store identifiers under its policy.
• FlagCDN and social-network links may receive IP address and technical data when an external resource loads or opens even if they do not set a Predict The Cup cookie.
• Google AdSense: the current metatag is only used to validate the account. After approval and ad activation, Google may place or read cookies and use web beacons, IP addresses, and other identifiers for ad serving, measurement, fraud prevention, and permitted personalization.

Categories

• Necessary: session, technical consent, and core operation. Always active while the corresponding feature is used.
• Security: abuse prevention, OAuth, access limits, and account protection. Always active when needed.
• Preferences: optional interface and personalization choices. Activated according to the user's selection.
• Analytics: Vercel Analytics, Microsoft Clarity, and internal product events. Disabled until consent.
• Marketing: promotional communications and browser push. Disabled by default and dependent on consent plus additional browser permission for push.

Why some records are necessary

Without session and security controls, we cannot maintain sign-in, prevent unauthorized access, confirm purchases, or apply usage limits.

The technical consent cookie allows us to respect the stored choice and request a new decision when legal versions change.

Optional technologies

Analytics, Clarity, optional preferences, and marketing should work only after the relevant category is accepted. Internal product events also honor the Analytics choice.

We do not currently use Meta Pixel or TikTok Pixel. Google AdSense ad-serving code is not active yet. Before activation, this policy and inventory will be reviewed, and a Google-certified CMP will be used where required.

Managing or withdrawing choices

• Open Privacy Preferences in the footer to accept, reject, or change optional categories.
• Use Reject optional to retain only necessary and security functions.
• Disable notifications in the site prompt and in browser or operating-system permissions.
• After withdrawal, new optional tracking stops; data already processed lawfully may remain for the applicable retention period.

Browser settings

Your browser can delete or block cookies and storage. Blocking necessary records may end the session, prevent sign-in, lose preferences, and limit features.

Update and contact

• Version: 2026-06-09.
• Last updated: June 9, 2026.
• Questions about a specific identifier can be sent to support@predicthecup.com.