Cookies & Local Storage

These are required for the site to function. They run regardless of your consent choice.

• sc_consentFirst-party

  Records your choice from the cookie banner so we know whether to load analytics scripts on subsequent page loads.

  Set by: Scorecrypt (consent banner) · Retention: 1 year

• localStorage("theme")First-party

  Remembers your light/dark-mode choice so the page renders the right theme before content paints.

  Set by: Scorecrypt (theme script) · Retention: Persistent (until you clear browser storage)

• localStorage (Statsig SDK)First-party

  Caches feature-flag evaluations so the same gate decision applies consistently within a session. No advertising IDs are propagated.

  Set by: Statsig (feature flags) · Retention: Session-bound

• hCaptcha session cookiesThird-party

  Bot detection on signup and login. hCaptcha runs in an iframe and manages its own cookies on its own domain.

  Set by: hCaptcha · Retention: Managed by hCaptcha

• sentryReplaySession (currently disabled)First-party

  Session replay for debugging crashes. This feature is currently turned off platform-wide; the entry is listed for transparency.

  Set by: Sentry (when session replay is enabled) · Retention: Session-bound

These load only after you click Allow analytics on the cookie banner. For users we have classified as minors (under 18 via the age gate), analytics scripts are server-side blocked regardless of consent state.

• _ga, _gid, _ga_<measurement-id>Third-party · consent-gated

  Anonymized usage analytics. Only loads after you click "Allow analytics" on the consent banner. Never loads for users in our minor age tiers (CHILD, TEEN), regardless of consent state.

  Set by: Google Analytics · Retention: _ga: 2 years; _gid: 24 hours

• Statsig page-view eventsFirst-party · consent-gated

  Aggregated page-view counts that help us see which features users actually reach. No content payload; no ad-network propagation.

  Set by: Statsig (page-view tracker) · Retention: Per Statsig data-retention defaults (90 days for raw events)

None today. Scorecrypt does not load any third-party advertising or remarketing scripts on any page. Targeted advertising is permanently disabled for accounts belonging to minors. If we ever add a marketing script, this section will list it and we will re-prompt for consent before it loads.