Cookies & On-Device Storage

1. What we store, and why

Two cookies, and a few settings kept in your browser's own storage. That is the whole list.

• sv_session — a signed cookie that keeps you signed in for 30 days. It is httpOnly, so scripts on the page cannot read it, and it is sent only over HTTPS.
• sv_oauth_state — a short-lived cookie, ten minutes at most, used only while you sign in with Google or Apple. It stops an attacker hijacking that round-trip.
• Your theme and language — light or dark, English or Kiswahili, kept on your device so the app opens the way you left it.
• Guest likes, saves and collections — if you are not signed in, these stay on your device and are never sent to us. Sign in and they move to your account.

2. What we do not use

No advertising cookies. No third-party trackers. No pixels following you to other sites. No selling of behavioural data to anyone.

If we ever add analytics or advertising, we will update this page, ask for your consent before switching it on, and give you a clear way to say no.

3. Staying in control

You can clear cookies and site data at any time from your browser settings. Doing so signs you out and resets your theme and language, and any guest saves held only on that device will be lost.

Blocking the session cookie entirely means you can still browse SokoVerse, but you will not be able to sign in.