Legal
Cookie Policy
Small files. Big rules. Exactly what we store in your browser, why we store it, and how to change your decision.
Roleplay Project uses cookies and similar technologies so we can keep you signed in, remember your preferences, and run the security plumbing the site needs to work. We do not use third-party advertising or cross-site tracking cookies. This page explains exactly what we set and why, and how to change your mind.
1. What cookies are, briefly
A cookie is a small text file that a website asks your browser to store. The browser sends it back to the same site on each visit, so the site can recognise you, remember a preference, or keep a session secure. "Similar technologies" includes things like localStorage and sessionStorage, which your browser keeps on its own but works the same way in practice.
Some cookies are essential: the site genuinely cannot work without them. Others are functional: they make the site nicer to use (saving your last view, remembering you've accepted this banner) but the site would still load if you turned them off.
2. Our lawful basis
Under the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR, we rely on two lawful bases:
- Strictly necessary cookies do not require consent under regulation 6(4) PECR, because they're necessary to provide the service you've explicitly asked for (e.g. signing into the UCP, keeping that session secure).
- All other cookies require your prior consent under regulation 6(1) PECR + UK GDPR Article 6(1)(a). That's the consent we ask for via the banner.
If you click Essential only, we will not set any cookie that isn't strictly necessary, and the site will still work.
3. The exact cookies and storage we use
3.1 On roleplayproject.net (this site)
| Name | Category | Purpose | Lifetime |
|---|---|---|---|
rpp_cookie_consent | Essential | Records that you've accepted the cookie banner so we don't show it again. Without it, we cannot honour your choice on later visits. | 12 months |
__cf_bm | Essential | Set by Cloudflare in front of our edge to distinguish humans from bots. Required for the site to be reachable safely. | 30 minutes |
cf_clearance | Essential | Set by Cloudflare after a successful challenge to avoid challenging you on every request. | up to 1 hour |
3.2 On ucp.roleplayproject.net (the UCP)
| Name | Category | Purpose | Lifetime |
|---|---|---|---|
ucp_token | Essential | HTTP-only signed JWT that proves you're signed in. Scoped to .roleplayproject.net so the bug portal, age-verification flow, and other sub-products share the session. Cleared on logout. | 24 hours |
ucp_device | Essential | Records a trusted device so we don't email-challenge you on every sign-in from this browser. Cleared if you choose "this isn't my device". | 90 days |
rpp_cookie_consent | Essential | Same role as on the marketing site. | 12 months |
3.3 Local storage (your browser, not transmitted to us)
| Key | Category | Purpose | Lifetime |
|---|---|---|---|
rpp_cookie_consent | Essential | Mirror of the cookie above so the banner doesn't briefly flash on subsequent visits before the cookie is read. | Until you clear browser storage |
card_share_* | Functional | Used by the UCP to remember which Cards series you most recently viewed in the marketplace. | Until you clear browser storage |
3.4 Analytics
If, and only if, you choose Accept all, we load Google Analytics 4 (Google Ireland Limited) to understand which pages people read and where visitors arrive from. Choosing Essential only means the Google tag is never requested at all, so no analytics cookie is ever written. This is a hard gate in the page code, not a preference we ask Google to respect after the fact.
Google Analytics sets _ga and _ga_<container> cookies to distinguish one browser from another. They expire two years after they are last set. We enable IP anonymisation, and we do not link analytics data to your account, your characters or any in-game activity. You can read Google's Privacy Policy or install Google's opt-out browser add-on.
3.5 What we don't use
We do not run Meta Pixel, TikTok Pixel, third-party advertising SDKs, or any cross-site advertising tracker. We do not sell behavioural data. Aside from the analytics tag described above, which you control, nobody is following you off this site.
4. Changing your mind
Update your preferences
You can change your decision at any time. Choosing Essential only will clear any non-essential cookies on this browser on your next visit.
You can also clear cookies from your browser's settings at any time. Some browsers offer a "block all cookies" mode. If you use this, parts of the Service that depend on the essential cookies above will stop working (you won't be able to sign in to the UCP, for example).
5. Third-party cookies
Where we embed an external service that requires cookies, those cookies are set by that third party under their privacy and cookie policies, not ours. The third parties we currently embed are:
- Google (Google Ireland Limited): the Google Analytics tag described in section 3.4, loaded only after you choose Accept all. The homepage background video is served from our own servers, so it makes no third-party request and sets no third-party cookie.
- Didit: identity-verification partner used to confirm 18+ status for the small number of applicants we need to verify. Didit handles its own session on its own domain; their cookies and processing live under Didit's privacy policy.
- Discord: widget and "sign in with Discord" flows redirect you to Discord's domain, where Discord may set its own session cookies. See Discord's Privacy Policy.
- Cloudflare: the network in front of our domains may set short-lived security cookies (e.g.
__cf_bm) to protect against bots and abuse. See Cloudflare's cookie policy. - Font services: we load typefaces from Google Fonts and Font Awesome's CDN. These do not set cookies on our origin but may log IP addresses for caching.
- Resend: transactional email provider that handles outbound emails (account verification, applications, invoices). Resend does not set cookies on our site.
Where a third-party cookie is set, it is set by that third party, not by us, and is governed by their policies. We do not place advertising or behavioural-tracking cookies on this site.
6. Updates to this policy
We may change this policy from time to time. We'll update the effective date above and, where the change is material, ask for your consent again the next time you visit.
7. Contact
Questions about cookies, data, or your rights? Email us at [email protected], or write to Phytoventures Ltd, Belmont Suite, Chorley New Road, Horwich, Bolton, England, BL6 6HG. You can also complain directly to the UK Information Commissioner's Office at ico.org.uk.
The rest of the legal shelf
These four documents work together. Read them alongside one another.