Cookie Policy

Every cookie and every piece of browser storage this site sets, what each does, how long it lasts, and why you are not being asked to consent to any of it.

Effective: September 19, 2026

Cookies (link to this section)

These are set by this site and sent back to it only. None of them are readable by another domain.

Name: solo_session_live: What it doesKeeps you signed in. Holds your Discord ID, username, display name and avatar hash, signed with an HMAC so it cannot be edited or forged.; How long it lasts7 days; Readable by scriptsNo, HTTP-only
Name: solo_session_user: What it doesHolds your Discord ID so the page knows instantly that you are signed in and can paint the header without waiting on a request. It holds nothing else, precisely because scripts can read it.; How long it lasts7 days; Readable by scriptsYes
Name: oauth_state_live: What it doesProves the response coming back from Discord belongs to the sign-in you started, which is what stops a forged sign-in link.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only
Name: oauth_csrf_live: What it doesA second check on the same exchange, so a stolen state value on its own is not enough.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only
Name: oauth_return_to_live: What it doesRemembers the page you were on so you land back there instead of the home page.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only

Cookies set by this site
Name	What it does	How long it lasts	Readable by scripts
`solo_session_live`	Keeps you signed in. Holds your Discord ID, username, display name and avatar hash, signed with an HMAC so it cannot be edited or forged.	7 days	No, HTTP-only
`solo_session_user`	Holds your Discord ID so the page knows instantly that you are signed in and can paint the header without waiting on a request. It holds nothing else, precisely because scripts can read it.	7 days	Yes
`oauth_state_live`	Proves the response coming back from Discord belongs to the sign-in you started, which is what stops a forged sign-in link.	Deleted when sign-in finishes	No, HTTP-only
`oauth_csrf_live`	A second check on the same exchange, so a stolen state value on its own is not enough.	Deleted when sign-in finishes	No, HTTP-only
`oauth_return_to_live`	Remembers the page you were on so you land back there instead of the home page.	Deleted when sign-in finishes	No, HTTP-only

On a local development machine the sign-in cookies above that end in _live use a _local suffix instead. That is the only difference.

Browser storage (link to this section)

These never travel to the server. They sit in your browser and are read by the page itself.

Name: solo:auth:v1: KindLocal storage; What it doesA copy of your own display name and avatar, so the header renders immediately instead of flashing empty while the server answers. It is discarded when the sign-in marker cookie disappears.; How long it lasts7 days
Name: solo-shell-v1: KindService worker cache; What it doesStores the home page shell so the site opens fast and still opens on a bad connection. It holds no personal information.; How long it lastsUntil you clear site data

Browser storage used by this site
Name	Kind	What it does	How long it lasts
`solo:auth:v1`	Local storage	A copy of your own display name and avatar, so the header renders immediately instead of flashing empty while the server answers. It is discarded when the sign-in marker cookie disappears.	7 days
`solo-shell-v1`	Service worker cache	Stores the home page shell so the site opens fast and still opens on a bad connection. It holds no personal information.	Until you clear site data

Third-party requests (link to this section)

Your avatar is loaded straight from the Discord content network, so Discord sees that request. Discord sets no cookie on this site and we embed nothing else: no fonts from a third party, no videos, no maps, no chat widgets, no share buttons.

Turning them off (link to this section)

Your browser can block or clear all of this from its site settings, and clearing site data for this domain removes every item above at once. Blocking the sign-in cookies signs you out and keeps you signed out. The public pages still work, because reading the player database, signups and scrim blocks never required an account.

Changes (link to this section)

If this site starts setting something new, it is added to the tables above and the effective date at the top moves. Adding anything that is not strictly necessary would mean asking you first, and this page would say so.

Contact

Every request under this policy goes through the staff in our Discord server. Open a ticket or message a staff member directly.

Message staff on Discord

These are set by this site and sent back to it only. None of them are readable by another domain.

Name: solo_session_live: What it doesKeeps you signed in. Holds your Discord ID, username, display name and avatar hash, signed with an HMAC so it cannot be edited or forged.; How long it lasts7 days; Readable by scriptsNo, HTTP-only
Name: solo_session_user: What it doesHolds your Discord ID so the page knows instantly that you are signed in and can paint the header without waiting on a request. It holds nothing else, precisely because scripts can read it.; How long it lasts7 days; Readable by scriptsYes
Name: oauth_state_live: What it doesProves the response coming back from Discord belongs to the sign-in you started, which is what stops a forged sign-in link.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only
Name: oauth_csrf_live: What it doesA second check on the same exchange, so a stolen state value on its own is not enough.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only
Name: oauth_return_to_live: What it doesRemembers the page you were on so you land back there instead of the home page.; How long it lastsDeleted when sign-in finishes; Readable by scriptsNo, HTTP-only

Cookies set by this site
Name	What it does	How long it lasts	Readable by scripts
`solo_session_live`	Keeps you signed in. Holds your Discord ID, username, display name and avatar hash, signed with an HMAC so it cannot be edited or forged.	7 days	No, HTTP-only
`solo_session_user`	Holds your Discord ID so the page knows instantly that you are signed in and can paint the header without waiting on a request. It holds nothing else, precisely because scripts can read it.	7 days	Yes
`oauth_state_live`	Proves the response coming back from Discord belongs to the sign-in you started, which is what stops a forged sign-in link.	Deleted when sign-in finishes	No, HTTP-only
`oauth_csrf_live`	A second check on the same exchange, so a stolen state value on its own is not enough.	Deleted when sign-in finishes	No, HTTP-only
`oauth_return_to_live`	Remembers the page you were on so you land back there instead of the home page.	Deleted when sign-in finishes	No, HTTP-only

On a local development machine the sign-in cookies above that end in _live use a _local suffix instead. That is the only difference.

Browser storage

These never travel to the server. They sit in your browser and are read by the page itself.

Name: solo:auth:v1: KindLocal storage; What it doesA copy of your own display name and avatar, so the header renders immediately instead of flashing empty while the server answers. It is discarded when the sign-in marker cookie disappears.; How long it lasts7 days
Name: solo-shell-v1: KindService worker cache; What it doesStores the home page shell so the site opens fast and still opens on a bad connection. It holds no personal information.; How long it lastsUntil you clear site data

Browser storage used by this site
Name	Kind	What it does	How long it lasts
`solo:auth:v1`	Local storage	A copy of your own display name and avatar, so the header renders immediately instead of flashing empty while the server answers. It is discarded when the sign-in marker cookie disappears.	7 days
`solo-shell-v1`	Service worker cache	Stores the home page shell so the site opens fast and still opens on a bad connection. It holds no personal information.	Until you clear site data

Turning them off