Cookie Policy

1. What we set

The casebattle_session cookie holds your sign-in. It is HttpOnly (JavaScript cannot read it), SameSite=Lax, and Secure in production. It expires when your session does, and is cleared when you sign out or when a security event ends your sessions.

If you choose Google or Steam sign-in, reaper_social_auth binds that sign-in attempt to this browser. It is HttpOnly, SameSite=Lax and Secure in production, is restricted to authentication routes, expires after ten minutes and is cleared when the attempt completes. Provider identifiers link your account; matching email addresses never link accounts automatically.

Uploaded and imported profile pictures are normalized and stored by Elux. We do not display remote provider image URLs in the page. Profile pictures are public; removing a picture removes it from your profile but does not invalidate copies already cached or shared.

Another cookie, named reaper_chat_dock, remembers a single word: whether you left the chat panel open or closed. It is SameSite=Lax, holds no identifier and nothing personal, and exists only so the page is drawn at the right width before it reaches you.

If you contact support as a guest, the casebattle_support cookie lets this browser reopen its own conversations. It is HttpOnly, SameSite=Strict and restricted to support routes, with a maximum lifetime of one year. Deleting it removes this browser’s access to those guest conversations.

The site also uses your browser's local storage for interface preferences such as the sound setting and the layout options you last chose. That data stays in your browser and is never sent to us.

2. What we do not set

We do not embed advertising, analytics or third-party tracking scripts. Google and Steam authentication opens the provider only when you choose it; that provider handles its own sign-in cookies under its own policy. Elux requests only the account identity and profile information needed for sign-in.

Authentication and interface cookies support the features you request. If we add optional tracking storage, we will describe it and provide the applicable choices before enabling it.

3. Managing it

Every browser lets you view and delete stored site data. Deleting the session cookie signs you out; deleting local storage resets your interface preferences. Neither affects your balance, your inventory or your history, which live on our server.

4. Changes

This policy is version 2026-09-09, effective 9 September 2026. If the storage the site uses changes, this page changes with it.