Legal · cookies · August 2026

Cookies

The complete list of what this site stores in your browser, what we deliberately don't, and what has to happen before that list is ever allowed to grow.

The short version

This site sets only cookies it cannot work without: one to keep you signed in, and one to remember that you have seen the cookie notice. There are no analytics cookies, no advertising cookies, and no third-party tracking of any kind.

That is why the notice has one button. Nothing optional is being set, so there is nothing to decline — and the essential cookies continue whether or not you dismiss it. Dismissing it records that you have read this. There is nothing optional to agree to.

Every cookie we set

·sb-*-auth-token — your sign-in session, issued by Supabase Auth when you log in and refreshed while you use the site. First-party, essential. Signing out removes it; a long value may be split into numbered parts, which are the same cookie. If you never sign in, it is never set.

·frag-cookies-ack — remembers that you have seen the cookie notice, so it stops reappearing. First-party, essential to honouring your dismissal, lasts 12 months — after which we ask for a fresh read, because this page may have changed.

·That is the complete list. Anonymous visitors who never sign in and never dismiss the notice receive no cookies at all.

What we deliberately don't use

·No analytics or measurement cookies — we don't run any analytics script, first- or third-party.

·No advertising or profiling cookies, no fingerprinting, no session recording.

·No tracking pixels. We don't track email opens, because we said we wouldn't.

·No third-party embeds that smuggle their own cookies in with them.

If that ever changes

If we ever add a non-essential category — analytics is the likely candidate — it will be opt-in through the cookie notice before the first byte of it is set, and this page will be updated before the notice asks. We will not treat a past dismissal of this notice as consent to a category that did not exist when you clicked it.

Data on the Fragments platform

Cookies are a website mechanism; the mod and coordinator don't use them. What the platform collects while you play — what the mesh needs to run, what map sharing sends when you turn it on, what a bug report or log share includes when you ask for one, and the VBF_PHONE_HOME=off switch that stops everything optional — is listed in the privacy policy, §03 “What the mod sends, and when”. The same list is shown in-game under "What Fragments sends".

Managing cookies

Your browser can list, block, or delete cookies for this site at any time. Deleting the session cookie simply signs you out; deleting the acknowledgement brings the notice back. Blocking cookies entirely leaves every public page readable — you just won't be able to stay signed in.

This document describes what the site does honestly. It is not a formal legal contract. If Fragments scales to meaningful volume in the EU, UK, or California, a lawyer should review the cookie and consent wording alongside the privacy policy.