Cookies Policy
Last updated: September 2026
Introduction
Cookies and similar technologies are small files or stored values used by websites and applications. Kompetr uses them to operate the service securely, remember your choices and, with your consent, understand how the app is used.
What cookies we use
Kompetr uses essential cookies and storage, optional analytics, functional storage and user-requested preferences, security and anti-abuse technologies, and payment technologies when billing features are opened. You can manage optional analytics at any time.
Necessary cookies and storage (always on)
These technologies are required for Kompetr to function securely. They support sign-in, session management, account protection, CSRF prevention, language selection and essential app features. They cannot be disabled through the cookie settings.
Analytics cookies (optional)
With your consent, Kompetr uses Google Analytics 4 to understand how the service is used, measure performance, identify issues and improve features. Google Analytics may process information such as page views, interactions, browser and device information, and approximate location, and may set cookies including _ga and _ga_*. Analytics is not enabled unless you consent.
Security and anti-abuse technologies
Kompetr uses Cloudflare Turnstile on selected forms and sensitive actions to protect the service from bots, spam and abuse. Turnstile processes technical information and creates a single-use verification token that expires after five minutes.
Payment and subscription technologies
When you use paid features, Paddle may use cookies, checkout sessions, redirects, transaction identifiers and fraud-prevention signals to process payments and manage subscriptions. These technologies are activated when you open or use Paddle's checkout or billing services.
Preference storage (optional)
Kompetr stores some optional interface choices, such as language, chart zoom, or selected display options, when you choose them. They are not used for analytics or advertising and can be removed by clearing browser storage.
How to manage cookies
You can use Kompetr's cookie settings to accept, reject, or withdraw consent for analytics. Rejecting analytics does not block core use. Necessary technologies cannot be disabled because they are required for the service to work. User-requested interface preferences can be removed through browser settings, although clearing all storage may affect sign-in, session persistence, and other essential features.
Third-party technologies
Kompetr uses third-party technologies where required to provide specific features. Google Analytics may process analytics data only with your consent. Paddle may process payment, subscription and fraud-prevention information when you use paid billing features. Cloudflare Turnstile may process technical signals when a configured security or anti-abuse check is displayed. These providers process information under their own privacy and cookie policies.
Updates to this policy
We may update this Cookies Policy from time to time. We will revise the "Last updated" date when changes are made.
Contact information
If you have questions about cookies, contact us at privacy@kompetr.com.
Technology details
The table below reflects the technologies detected in the current Kompetr implementation. Provider-controlled storage may change when an external checkout or security widget is used.
| Name / mechanism | Provider | Domain / location | Purpose | Category | Required | Expiry / deletion | Party |
|---|---|---|---|---|---|---|---|
| access | Kompetr | Current Kompetr host (host-only) | Short-lived authenticated application session. | Strictly necessary | Yes | 1 hour | First-party |
| refresh | Kompetr | Current Kompetr host (host-only) | Renews the authenticated session without requiring another login. | Strictly necessary | Yes | 7 days | First-party |
| superadmin_access | Kompetr | Current Kompetr host (host-only) | Marks an authenticated account that may access the operator console; set only for eligible accounts. | Strictly necessary | Yes | 7 days | First-party |
| kompetr_2fa_trusted | Kompetr | Current Kompetr host (host-only) | Remembers a device for 30 days only when the user selects the trusted-device option during two-factor authentication. | Security and anti-abuse | No | 30 days | First-party |
| csrftoken | Kompetr / Django | Current Kompetr API host (host-only) | Protects unsafe requests against cross-site request forgery. | Security and anti-abuse | Yes | Up to 31449600 seconds (Django default), renewed when the token is set | First-party |
| sessionid | Kompetr / Django | Current Kompetr API host (host-only) | Django server session, primarily for protected administrative interfaces where used. | Strictly necessary | Yes | Up to 2 weeks by default, or earlier on logout/session invalidation | First-party |
| cc_cookie | Kompetr / vanilla-cookieconsent | Current Kompetr host (host-only) | Stores consent categories, choice timestamps, language, consent ID, and policy revision. | Strictly necessary | Yes | 182 days; updated when consent changes | First-party |
| NEXT_LOCALE | Kompetr / Next.js | Current Kompetr host (host-only) | Remembers the language explicitly selected by the user. | Optional preferences | No | 1 year | First-party |
| kompete_maintenance_banner_dismissed | Kompetr | Current Kompetr host (host-only) | Remembers that the user dismissed the current scheduled-maintenance notice. | Functionality / requested preferences | No | Until the announced maintenance window ends | First-party |
| user, authSession, authLastActivityAt; legacy authTokens and access (read once, then removed) | Kompetr | localStorage | Caches limited account/session state and the last activity time; authentication tokens are held in HttpOnly cookies, while old local token keys are removed during migration. | Strictly necessary | Yes | Until logout, idle-session cleanup, replacement, or browser storage deletion | First-party |
| currentLeagueId*, nextGameCache*, homeSnapshotCache*, homeProgressCache*, messages:lastRoomId, kompete:selectedSeasonByLeague, kompete:seasonOptionsByLeague, kompete:league-membership, kompetr:invite-return, kompetr.signupPlanIntent | Kompetr | localStorage | Maintains the selected competition/season, navigation continuity, and short-lived application caches needed for responsive use. | Functionality / requested preferences | Yes | Until replaced, no longer needed, or browser storage is cleared | First-party |
| lang, theme*, kompete.homeChartZoomByMode.v1, kompeteApiPerf | Kompetr | localStorage | Remembers user-requested interface choices such as language, chart zoom, and selected display options. Theme keys may remain from versions where theme selection was enabled. | Functionality / requested preferences | No | Until replaced, no longer needed, or browser storage is cleared | First-party |
| kompetr.signupSuccessEmail, kompete.loginToHomeLoader, kompetr:last-authenticated-app-path; legacy localStorage signup_email (removed when read) | Kompetr | sessionStorage / legacy localStorage | Carries one-session navigation and signup state between related pages. | Functionality / requested preferences | Yes | Until the browser tab/session ends or the value is consumed | First-party |
| kompete:visitor:key:v1; kompete:visit:tracked:v1 | Kompetr | localStorage / sessionStorage | Pseudonymous visit measurement used only after analytics consent; removed when analytics is rejected or withdrawn. | Analytics | No | Until analytics consent is withdrawn/rejected or browser storage is cleared | First-party |
| _ga, _ga_<measurement-id> | Google Analytics 4 | Highest available Kompetr domain selected by Google Analytics | Distinguishes users and maintains Analytics session state after consent. | Analytics | No | 2 years from the latest qualifying interaction under GA4 defaults; cleared on withdrawal where accessible | First-party cookie; data sent to Google |
| Turnstile widget token and provider-controlled storage (if set) | Cloudflare Turnstile | challenges.cloudflare.com / current site if pre-clearance is enabled | Runs an anti-bot check only on forms/actions configured to require it. Kompetr does not enable Turnstile pre-clearance in application code. | Security and anti-abuse | Yes | Single-use token valid for 5 minutes; any provider-controlled storage follows Cloudflare's current security configuration | Third-party |
| Paddle checkout/customer-portal storage (provider-controlled) | Paddle | paddle.com and Paddle checkout domains | Provides hosted checkout, payment fraud prevention, and subscription/customer-portal functionality when billing features are opened or used. | Payments and subscriptions | Yes | Controlled by Paddle for the checkout/portal and its fraud, transaction, and legal-retention requirements; no fixed duration is configured by Kompetr | Third-party |