Cookie Policy

Cookies are small text files stored on your device when you visit a website. We also use related storage mechanisms (localStorage, sessionStorage, IndexedDB) which behave similarly for this Policy's purposes.

• access_token — your signed-in session (JWT, HttpOnly, SameSite=None, Secure). Without it you can't stay logged in. Lifetime: up to 30 days.
• session_token — Google OAuth session, if you signed in with Google. Same purpose as above.
• hc_cookie_consent (localStorage) — remembers whether you accepted or rejected non-essential storage.

These are required for the Platform to work and cannot be switched off.

• hc_lang — your chosen interface language.
• hc_paywall_dismissed — remembers if you dismissed the "create free account" prompt for the current session.
• hc_puzzle_solved_set — remembers which hero puzzles you've solved, so we don't repeat them.
• hc_pwa_* — remembers your PWA install-prompt choice.

These improve usability but the Platform still works without them.

We use two optional analytics tools — Google Analytics (aggregate traffic measurement) and PostHog (product analytics, including session replays of page interactions). Neither loads until you click "accept" on the cookie banner. If you choose "necessary only" (or dismiss the banner), no analytics scripts are loaded at all and no analytics cookies are set.

Separately, we use Sentry to capture frontend and backend errors; it may set a session-scoped cookie or write to localStorage. We do not use Facebook Pixel or any advertising tracker, with or without consent.

• Google Analytics — traffic measurement, only after you accept analytics cookies.
• PostHog — product analytics & session replay, only after you accept analytics cookies.
• Stripe — fraud prevention on payment pages.
• Google — only on the Google OAuth flow.
• Cloudflare Turnstile — bot challenge on register / login forms.

Each third party operates under its own privacy and cookie policies.

You can clear cookies and storage at any time using your browser settings. You can also block cookies entirely — note that doing so will sign you out and may break parts of the Platform that depend on session state. Mobile browser users can clear site data per-site.

You can also withdraw consent to non-essential storage from the cookie banner that appears on first visit, or by clearing your hc_cookie_consent entry.

We'll update this policy when we add or remove cookies. The effective date at the top reflects the latest version. Material changes will trigger the cookie banner to reappear.

Cookie-related questions: legal@hacking.community.