Cookies and local storage

Two cookies, a handful of things your own browser remembers, and no trackers.

There is no consent banner on this site, and that is not an oversight. A banner is what a site owes you when it stores things for its own purposes rather than yours. Everything below is here to make the game work, so there is nothing to ask you to agree to and nothing to switch off.

Two cookies, both about signing in

Signing in sets hexagonia_session, which says nothing but that this browser is signed in as somebody. It is marked HttpOnly, so no script can read it, Secure, so it only travels over HTTPS, and SameSite=Lax, so another site cannot make your browser send it. It lasts thirty days, and logging out deletes it. If you never sign in, this cookie never exists.

Choosing Google or Discord sets hexagonia_signin for the length of that trip, five minutes at most, and it is deleted the moment you come back whether the sign-in worked or not. It holds one random number and says nothing about you. It is there so that the answer coming back from Google or Discord is answering the browser that asked: without it, somebody could send you a link that signed you into their account instead of yours, which you might not notice.

What your browser remembers by itself

The rest is local storage, which never leaves your machine unless the game sends it somewhere for a reason given here. Clearing your site data removes all of it, and costs you nothing but a seat you were holding and a few settings.

  • Your guest token, so a reload or a second tab is still the same player and you keep your chair. It is the one thing here that is also sent to the server, on every call, because it is how the server knows which player you are.
  • The name that token spells, so the screen can greet you without asking the server again.
  • The game you are playing on your own, as a seed and a list of moves, so closing the tab does not lose it.
  • Your settings: the tab you were last on, how you like a table set up, and how loud the game is.

Other people's cookies

Signing in with Google or Discord sends you to them, and they use their own cookies to know who you are. Paying sends you to Stripe, who do the same. Both are their sites, under their policies, and neither sets anything here. The typefaces the site is set in are files on this server, so loading a page fetches them from here and tells nobody else that you asked.

Nothing on this site advertises, profiles you, or measures you for anybody. There is no analytics service, no tag manager and no pixel.

Last reviewed 2 October 2026.