Cookie Policy
Last updated: 27 September 2026
This page lists everything RPLudus stores on your device, why, and for how long, and explains how to change your choices. It adds to our Privacy Policy, which covers the rest of how we handle your personal data.
1. What Are Cookies?
Cookies are small text files a website saves in your browser. Your browser sends them back to that website on later visits. Websites can also save information in your browser’s local storage, which stays until it is cleared, or session storage, which is deleted when you close the tab. Unlike cookies, these are not sent to the website automatically.
The law treats all of these the same way, and so does this policy: when we say “cookies” we mean any of them.
2. Cookies We Use
The law lets a website store information on your device without asking when it is strictly necessary to provide something you asked for, such as signing in, paying, or remembering a setting you chose. Section 2.1 and the settings in section 2.2 are stored on that basis. Section 2.2 also lists a few short histories the site keeps automatically (your recent searches, emoji and GIFs, and the tabs you last switched to); they are not settings you chose, they stay on your device, and you can clear them. Nothing in sections 2.1 or 2.2 can be switched off in the cookie banner. Analytics (section 2.3) only runs if you consent. We do not use cookies for advertising, and we do not sell what they hold.
2.1 Essential Cookies
These make signing in, security and the site itself work. Without them you cannot stay signed in.
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| sb-<project>-auth-token | ProviderRPLudus (via Supabase) | PurposeKeeps you signed in. It may be split into numbered parts (.0, .1). The site signs you out after 7 days without activity, or 30 days after you signed in. | Kept in / how longCookie · Until you sign out (your browser deletes it after 400 days at most) |
| sb-<project>-auth-token-code-verifier | ProviderRPLudus (via Supabase) | PurposeProtects sign-in through an email link or another account, by checking that the sign-in finishes in the browser that started it. | Kept in / how longCookie · Until you finish signing in (400 days at most) |
| sb-<project>-auth-token-flow-<id>-code-verifier | ProviderRPLudus (via Supabase) | PurposeThe same check, one for each sign-in you have started but not finished (for example in two tabs), up to five at a time. | Kept in / how longCookie · Until you finish that sign-in or sign out (400 days at most) |
| sb-<project>-auth-token-flows-code-verifier | ProviderRPLudus (via Supabase) | PurposeA list of the sign-ins you have started but not finished, so each one is checked against the right entry above. | Kept in / how longCookie · Until you finish signing in or sign out (400 days at most) |
| rpludus-recovery-pending | ProviderRPLudus | PurposeConfirms you opened a valid password-reset link before you choose a new password. | Kept in / how longCookie · 15 minutes |
| rpludus: | ProviderRPLudus | PurposeHolds the email address you just signed up with, so the “Check your email” page can show it and resend the confirmation email. It is kept here rather than in the page address, so it does not reach logs or error reports. | Kept in / how longSession storage · Until you close the tab, or sooner once that page sees your email is confirmed |
| rpludus: | ProviderRPLudus | PurposeRemembers whether you ticked “Remember me” when you signed in. | Kept in / how longLocal storage · Until you clear it |
| rpludus: | ProviderRPLudus | PurposeTells moving between pages apart from closing the browser. A marker in session storage is set on every visit, signed in or not. If you did not tick “Remember me”, a flag in local storage is also set as you leave a page, so you are signed out on your next visit if the browser was closed. | Kept in / how longSession storage until you close the tab; local storage until your next visit |
| rpludus: | ProviderRPLudus | PurposeThree entries that enforce the automatic sign-out: your account ID, when you signed in, and when you were last active. When the site signs you out automatically, a fourth entry records why (inactivity or the 30-day limit); the site does not currently use it for anything. | Kept in / how longLocal storage · The first three until you sign out; the fourth until you next sign in on this browser |
| rpludus: | ProviderRPLudus | PurposeWhen you sign out in one tab, signs you out in your other open tabs too. | Kept in / how longLocal storage · Until you clear it |
| rpludus_ | ProviderRPLudus | PurposeRemembers your choices in the cookie banner, and when you made them, so we do not ask on every visit. | Kept in / how longLocal storage · Until you change your choice or clear it |
| rpl-stale-reload-at | ProviderRPLudus | PurposeAfter we release an update, reloads the page once so you get the new version, and stops it reloading again in a loop. | Kept in / how longSession storage · Until you close the tab |
These are only set when you pay for a booking by card, on the payment pages:
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| rpl_ | ProviderRPLudus | PurposeLinks a card confirmation back to your booking and stops it being reused. | Kept in / how longCookie · 15 minutes |
| rpl_ | ProviderRPLudus | PurposeCarries a payment that needs an extra check by your bank to its next step. | Kept in / how longCookie · 5 minutes |
| rpl_ | ProviderRPLudus | PurposeStops a payment being sent twice, and lets you resume it if the page reloads. Holds booking and payment reference numbers, not card details. | Kept in / how longSession storage · Until you close the tab |
| _ | ProviderStripe | PurposeSet by Stripe, our payment provider, to detect and prevent card fraud. | Kept in / how longCookie · 1 year (per Stripe) |
| _ | ProviderStripe | PurposeSet by Stripe to detect and prevent card fraud during this payment. | Kept in / how longCookie · 30 minutes (per Stripe) |
Stripe’s cookies are set by Stripe’s payment script, and Stripe may keep similar information inside its payment form. Stripe describes them in its cookie policy. Your card details go straight to Stripe; we never see or store them.
2.2 Preferences and Features You Use
These remember a choice you make on this device, or keep something you are working on. Apart from the Community Hub layout cookie, they stay in your browser and are not sent to us. They hold only the choice itself, except where the table says otherwise. Clearing them brings back the defaults.
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| rpludus_ | ProviderRPLudus | PurposeRemembers the Community Hub layout you picked (grid or list), so the page opens in it. Your browser sends it to our server with every page under /communities (the Hub and each community’s pages), but only the Hub uses it. | Kept in / how longCookie · 1 year |
| communities: | ProviderRPLudus | PurposeThe same layout choice, kept in your browser so it can be restored if the cookie expires. | Kept in / how longLocal storage · Until you clear it |
| theme | ProviderRPLudus | PurposeRemembers whether you use light or dark mode. | Kept in / how longLocal storage · Until you clear it |
| rpludus_ | ProviderRPLudus | PurposeRemembers which sidebar sections you have collapsed or expanded. | Kept in / how longLocal storage · Until you clear it |
| rpludus: | ProviderRPLudus | PurposeRemembers whether you left the Daily Quests panel open or closed. | Kept in / how longLocal storage · Until you clear it |
| rpludus_ | ProviderRPLudus | PurposeKeeps your open chat windows in the same order as you move between pages. Holds the account IDs of the people you are chatting with. | Kept in / how longSession storage · Until you close the tab |
| rpludus. | ProviderRPLudus | PurposeRemembers whether you muted the sound on the dice-roll intro animation. | Kept in / how longLocal storage · Until you clear it |
| rpludus-profile-intro-seen | ProviderRPLudus | PurposeStops the profile set-up intro playing more than once per visit. | Kept in / how longSession storage · Until you close the tab |
| rpludus: | ProviderRPLudus | PurposeRemembers if you chose to keep the Bazaar preview open instead of replaying its reveal animation. | Kept in / how longLocal storage · Until you clear it |
| rpludus: | ProviderRPLudus | PurposeSaves the title and text of a community post you are writing but have not sent yet, so it survives a reload. Named with your account ID and the community. Deleted when you send it, discard it or sign out. | Kept in / how longLocal storage · Until sent, discarded or you sign out |
The site also keeps these short histories in your browser automatically, to show recent items first or reopen the tab you last used. They are not settings you chose, and they are never sent to us. You can clear your recent searches in the search box; to clear the others, delete this site’s data in your browser (section 3).
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| rpludus: | ProviderRPLudus | PurposeYour last 6 searches, saved each time you search and shown in the search box. You can clear them there. | Kept in / how longLocal storage · Until you clear it |
| rpludus. | ProviderRPLudus | PurposeThe last 24 emoji you used, including in chat, saved each time you use one and shown first in the emoji picker. | Kept in / how longLocal storage · Until you clear it |
| rpludus. | ProviderRPLudus | PurposeThe last 24 GIFs you picked, saved each time you pick one and shown first in the GIF picker. | Kept in / how longLocal storage · Until you clear it |
| rpludus. | ProviderRPLudus | PurposeThe homepage feed tab (For You, Following or All) you last switched to, saved each time you switch, so the homepage reopens on it. | Kept in / how longLocal storage · Until you clear it |
| rpludus_ | ProviderRPLudus | PurposeThe tab (Pinned, Most visited or Recent) you last switched to in the sidebar’s Communities widget, saved each time you switch. Named with your account ID so each account on a shared browser keeps its own. | Kept in / how longLocal storage · Until you clear it |
Our staff testing tools also keep settings in the browser, under names starting with rpludus:dev: or rpludus-dev-. They are only written on staff devices.
2.3 Analytics
These only run if you switch on Analytics in the cookie banner (or choose “Accept All”). The legal basis is your consent, which you can withdraw at any time (section 3). If you do not consent, none of this runs.
- Vercel Web Analytics counts page views, where visitors came from, and their country, browser, device and operating system, so we can see which parts of RPLudus are used. Vercel, our hosting provider, says it does not use cookies for this and counts visitors with an identifier that resets every day.
- Page speed measurements (Core Web Vitals) record how quickly pages load and respond, with the page address, and send them to our own server. Very slow results are also sent to Sentry. These are our own statistics on how fast RPLudus is for visitors, which is why they need your consent; section 2.6 explains the separate timing data Sentry collects to find faults.
- Sentry Session Replay records a replay of what happens on the page (clicks, scrolling, page changes) in about 1 in 10 visits, and in visits where something breaks, so we can find and fix bugs. If you switch Analytics off and back on without closing the tab, the rest of that visit is recorded. Text, what you type and images are hidden before anything is sent. Each replay shows one visit and is linked to it by a random ID. If you are signed in, it is also tagged with your account ID (the random code that identifies your account, not your name or email address), so replays are not anonymous. Replays are never recorded on the payment pages.
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| sentryReplaySession | ProviderSentry | PurposeLinks the parts of one session replay together (see below). Only set if you allow analytics. | Kept in / how longSession storage · Until you close the tab or switch analytics off |
How long this is kept: Vercel keeps Web Analytics data for that service’s retention period. Page speed measurements are kept in the logs of Vercel, our hosting provider, for its log retention period. Sentry keeps replays for the retention period set for our Sentry account.
2.4 Marketing Cookies
We do not use marketing cookies. The cookie banner has a switch for them, but nothing on the site uses it. If we ever add marketing cookies, we will update this policy and ask for your consent before setting any.
2.5 Videos and Radio From Other Sites
Posts can include videos from YouTube (through its privacy-enhanced youtube-nocookie.com player), Twitch or Kick. Nothing is loaded from those sites until you press play. When you do, that site’s player loads inside RPLudus and may set its own cookies or storage, under its own privacy and cookie policy.
The lo-fi radio on the homepage plays a live stream from ilovemusic.de (its “I Love Chillhop” and “I Love Chillout Beats” channels). Nothing is requested from the station until you press play. Pointing at or focusing the play button may open a connection to ilovemusic.de in advance, so the music starts sooner, but sends no request. When you press play, ilovemusic.de sends your browser on to its stream server on radiohost.de. Like any website, these servers receive your IP address and browser details, and they may set their own cookies under their own policies. When we checked, the stream server set this cookie:
| Name | Provider | Purpose | Kept in / how long |
|---|---|---|---|
| AISSessionId | Providerradiohost.de (the radio’s stream server) | PurposeSet by the stream server when you press play on the homepage radio. We do not control it and do not know what it is used for. | Kept in / how longCookie · 100 minutes (as set by the stream server when we checked) |
2.6 Error Reports and Performance Monitoring
When something breaks in your browser, the site sends an error report to Sentry, our error-monitoring service, through our own server. It contains the error, the page address, your browser and device type, and the steps just before the error. For about 1 in 10 page loads and page changes it also sends timing data: how long the page and the requests it made took, including the same kind of speed measurements as section 2.3, so we can find pages and requests that are slow or failing. For each page you view it also sends a short status record (a random ID, your browser type and whether an error happened), so we can see how often visits go wrong. We have set it up not to send your cookies, your name or your email address, and it does not store anything on your device. If you are signed in, the error reports, timing data and status records sent after the page has checked your sign-in (almost all of them) are tagged with your account ID (the random code that identifies your account), so we can see how many people a fault affects. Sentry stores this data in its EU region (Germany) and keeps it for the retention period set for our Sentry account.
This does not depend on the cookie banner. We do it to keep RPLudus working and secure (our legitimate interest). That is the difference from the speed measurements in section 2.3: those are statistics about how fast the site is for visitors, and need your consent; the timing data here is a small sample Sentry takes as part of finding and fixing faults.
You have the right to object to this at any time, on grounds relating to your particular situation (Article 21 of the GDPR). There is no switch for it on the site. If you object, email us (section 5). Unless we have compelling legitimate grounds that override your interests, we will delete the reports tagged with your account ID. Reports without it (sent while you were signed out, or before a page had checked your sign-in) we can only try to find from details you give us, such as the time and the page. We cannot yet stop new reports being sent from your browser; until we can, you can stop them yourself by blocking requests to /api/sentry-tunnel with a content blocker; the site keeps working without them.
3. Managing Your Preferences
- Change or withdraw consent at any time with the “Cookie Settings” link in the site footer. Switching analytics off stops session replay straight away in the tab where you change it. The rest of analytics, and session replay in any other RPLudus tabs you have open, may continue until you next open or reload RPLudus. Withdrawing is as easy as giving consent and does not affect anything else on the site.
- Delete what is stored in your browser settings, under cookies and site data for RPLudus. This removes cookies, local storage and session storage together. Signing out also removes the sign-in cookies and your unsent drafts.
- Block cookies in your browser settings if you prefer. If you block the essential ones, you will not be able to sign in or pay, and your settings will not be remembered.
4. Your Rights
Most of what is listed above stays on your device and never reaches us. For the personal data we do receive, the GDPR gives you the right to access it, correct it, have it deleted, restrict how we use it, receive a copy to take elsewhere, and object to uses based on our legitimate interests. Withdrawing consent does not make what we did before you withdrew it unlawful. Our Privacy Policy explains these rights, who processes your data for us, and how data sent outside the European Economic Area is protected.
You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the data protection authority in the EU country where you live or work. You are welcome to contact us first.
5. Contact Us
RPLudus is responsible for the cookies it sets (it is the data controller). If you have questions about this policy or want to use your rights, email privacy@rpludus.com.
6. Changes to This Policy
When what we store changes, we update this page and the date at the top. If we add a new kind of optional cookie, we will ask for your consent again before using it.
See also: Privacy Policy