Cookie Policy — GridBlitz

1. About This Policy

Cookies are how websites stay useful between page loads — keeping you signed in, remembering your settings, telling humans apart from bots. But they're also where many sites quietly start tracking you across the web. This Policy is GridBlitz's straightforward answer to "so what's GridBlitz actually doing with cookies?" — and we have tried to keep that answer narrower than what is typical.

Today GridBlitz uses cookies only for essential and functional purposes — things like keeping you signed in and protecting account creation, email sign-in links, and password resets from automated abuse. We do not run advertising cookies, behavioral trackers, or third-party analytics that follow you across other sites. If that changes in the future, this Policy will update first, and we have made a forward-looking commitment in Section 5 to put a consent banner in place before any non-essential cookies start firing.

This Cookie Policy works alongside the GridBlitz Terms of Service ("Terms") and Privacy Policy. The Terms govern your relationship with the Platform generally; the Privacy Policy explains how we handle your data overall; this Cookie Policy is the focused disclosure for cookies specifically. The three documents together govern your relationship with GridBlitz.

Your acceptance. By creating an account, accessing the Platform, or using any feature, you confirm you have read and understood this Cookie Policy. Continued use of the Platform after a material change to this Policy is your acceptance of the change (subject to the notice mechanism in Section 9).

2. Definitions

This Section defines cookie-specific terms used in this Policy. Terms already defined in the GridBlitz Terms of Service (Account, Host, Player, Platform, etc.) carry through to this Policy without restating them; see Terms Section 2 for those.

• Cookie — a small piece of data your browser stores on your device when you visit a website. The website can read the cookie back later to remember something about your session (for example, that you're already signed in).
• First-party cookie — a cookie set by the website you are visiting (in our case, GridBlitz itself). The data goes directly to GridBlitz; no third party is involved.
• Third-party cookie — a cookie set by a different domain than the one you're visiting, usually because the website you're on embeds a service from somewhere else. In our case, the only third-party cookie comes from Cloudflare's bot-protection service (see Section 4.1 and Section 6).
• Session cookie — a cookie that goes away when you close your browser. Used for things that only need to last as long as your visit (or, in our case, your active sign-in session).
• Persistent cookie — a cookie that stays on your device for a set amount of time (could be hours, days, or longer), so the website can remember something between visits.
• HttpOnly — a technical flag on a cookie that means the cookie can only be read by the web server, never by JavaScript running in your browser. This protects against a class of attacks where a malicious script tries to steal your session token. GridBlitz's session cookie is HttpOnly by default.
• Secure — a technical flag on a cookie that means the cookie is only sent back to the server over an encrypted HTTPS connection, never over plain HTTP. GridBlitz's cookies are Secure by default.
• SameSite — a technical flag that controls whether a cookie is sent when you arrive at GridBlitz via a link from another site. The three values are Lax (cookie sent on most cross-site navigation — the default GridBlitz uses, which lets emailed game-invite links work), Strict (cookie never sent on cross-site navigation), and None (cookie always sent, but only over an encrypted HTTPS connection). This affects cross-site interactions like clicking an emailed game-invite link.
• Essential cookies — cookies the Platform cannot function without (authentication, security, abuse prevention). These cannot be disabled while you use the Platform.
• Functional cookies — cookies that remember your preferences (display settings, notification choices) but aren't strictly required to sign in. These are also currently always on; if you want them off, the cleanest path is to stop using the relevant features (your preferences won't persist between sessions).
• Analytics cookies — cookies that help operators understand how a website is being used in aggregate. GridBlitz does not currently use any analytics cookies (see Section 4.3).
• Advertising cookies — cookies that track you across the web for advertising purposes. GridBlitz does not use advertising cookies (see Section 4.4) and does not plan to.
• ePrivacy Directive — the European Union's specific law on cookies and electronic communications (a "Directive" is an EU law that each member country must put into its own national law; sometimes called the "Cookie Law"). It works alongside the EU's General Data Protection Regulation (GDPR) to set cookie-consent rules in the EU and UK.
• GDPR — the General Data Protection Regulation, the EU's foundational privacy law. Adds rights and obligations for cookies that store personal data.
• CCPA — the California Consumer Privacy Act, the US state privacy law that gives California residents specific rights over their personal information. CCPA has narrower cookie-specific rules than GDPR but still applies to certain tracking cookies.
• Consent banner — the "Accept / Reject / Manage" widget some websites show on first visit, asking you to choose which non-essential cookies you allow. GridBlitz does not show a consent banner today because the Platform uses only essential and functional cookies (per Section 5 forward commitment).

3. What Cookies Are (Plain English)

When you visit a website, the website often needs to remember something about you while you're there — for example, that you're signed in, or that you've chosen a particular preference. The way it remembers is by asking your browser to store a small piece of data called a cookie and to send that cookie back the next time you make a request. Cookies are how the modern web works; nearly every site you use today sets at least one cookie.

There are two big categories of cookies based on how long they last:

• Session cookies disappear when you close your browser. They're used for things that only matter during your current visit.
• Persistent cookies stay on your device for a set time (minutes, days, weeks, or longer). They're used for things you want the site to remember between visits.

And two categories based on who sets them:

• First-party cookies come directly from the site you're visiting (in our case, GridBlitz).
• Third-party cookies come from a different domain that's embedded in the site (in our case, Cloudflare's bot-protection service when it runs on our account-creation, email-sign-in-link, and password-reset pages).

GridBlitz uses both first-party and third-party cookies, but only the minimum needed to keep the Platform working and secure. We don't use cookies to track you across the web, build advertising profiles, or follow your browsing behavior outside GridBlitz. This posture reflects what GridBlitz is: a SaaS coordination platform for private group games — not an advertising-supported network and not a public marketplace. The next Section enumerates exactly what cookies are set and why.

4. Cookie Categories and Inventory

We organize cookies into four standard categories: Essential, Functional, Analytics, and Advertising. For each category, we list the specific named cookies (if any) that fire on the Platform today, their purpose, where they come from, and how long they last.

Quick reference — 4 categories this section covers:

• §4.1 Essential cookies — currently active; required to sign in and protect against automated abuse
• §4.2 Functional cookies — currently active; most preferences are stored server-side so the browser-cookie footprint is minimal
• §4.3 Analytics cookies — currently NONE (no Google Analytics, Mixpanel, Segment, or equivalent)
• §4.4 Advertising cookies — currently NONE and no plans to add (positive commitment, not just a default)

4.1 Essential Cookies (Currently Active)

Essential cookies are required for the Platform to function. Without them, you cannot sign in, your session would not stay open, and security protections against automated abuse would not work. These cookies do not require your consent under EU law (ePrivacy Directive Article 5(3) — "strictly necessary" exemption) because they are necessary for delivering a service you've requested.

See Section 6 for full disclosure on the Cloudflare third-party relationship.

4.2 Functional Cookies (Currently Active)

Functional cookies remember your preferences so the Platform behaves the way you've configured it. They aren't strictly required to sign in, but turning them off would reset preferences between sessions.

GridBlitz today stores most user preferences (notification settings, custom tile name, block list, etc.) server-side, tied to your Account in the database, rather than in browser cookies. So the functional-cookie footprint is currently minimal:

4.3 Analytics Cookies (Currently NONE)

GridBlitz does not currently use any analytics cookies. No first-party analytics tracking, no third-party analytics SDKs (no Google Analytics, no Mixpanel, no Segment, no Heap, no Amplitude, no equivalent), no behavioral analytics that profile your activity inside GridBlitz (the kind of tracking that records every click, scroll, and dwell-time to build a usage portrait of you) beyond what is needed for the audit log described in our Privacy Policy Section 2.6.

If GridBlitz adds analytics cookies in a future release, this Section will be updated to enumerate them — and per Section 5, a consent banner will be in place before those cookies fire for the first time.

4.4 Advertising Cookies (Currently NONE)

Advertising cookies are how most of the modern web tracks you. GridBlitz has made the deliberate decision not to use them. No third-party advertising trackers, no social-media pixels (no Facebook Pixel, no LinkedIn Insight Tag, no TikTok Pixel, no equivalent), no retargeting cookies (cookies that recognize you across other websites to follow you with ads for products you looked at on GridBlitz), no cross-site behavioral profiling, no advertising network integrations (third-party ad-delivery systems like Google Ads, Meta Ads, or programmatic ad exchanges).

This is a positive commitment, not just a default. The Platform's monetization model (host-side platform-access pricing per the Refund Policy) does not depend on advertising revenue; we do not plan to introduce advertising cookies. If that ever changed in a future Season's release, this Section would update first, a consent banner would deploy (per Section 5), and we would notify Users of the material change per Section 8.

5. Forward Commitment — Banner Before Non-Essential Cookies

GridBlitz makes the following forward-looking commitment as a matter of Policy:

We will not deploy non-essential cookies (analytics, advertising, or any other category beyond the essential and functional categories described in Section 4.1 and Section 4.2) without first implementing a consent banner that asks you to choose which categories you allow.

The consent banner mechanism, when deployed, will:

• Present the choice on your first visit (and again if material changes occur)
• Allow you to Accept All, Reject All Non-Essential, or Manage Preferences (granular per category)
• Remember your choice (in a first-party functional cookie disclosed in Section 4.2 once added)
• Provide a clear way to change your choice later via Account Settings

This commitment goes beyond what US federal law (and most US state laws) strictly require. We make it because we believe Users should have a meaningful choice about non-essential tracking, not just a disclosure they cannot act on.

(to be finalized before launch)

6. Third-Party Cookie Disclosures

GridBlitz uses one third-party service whose cookies may fire on Platform pages: Cloudflare Turnstile (bot protection).

6.1 Cloudflare Turnstile

(to be finalized before launch)

Cloudflare Turnstile is a bot-protection service we use when you create an account, ask for an email sign-in link, or reset your password, to help tell humans apart from automated bots without making you solve a traditional CAPTCHA puzzle (the "click all the traffic lights" or "identify the bicycles" image challenges most sites use to confirm you're a human; CAPTCHA is short for "Completely Automated Public Turing test to tell Computers and Humans Apart"). When Cloudflare Turnstile evaluates your browser, it may set the __cf_bm cookie (see Section 4.1) to remember the result for a short window (typically about 30 minutes) so you don't have to be re-evaluated on every form submission.

What Cloudflare receives from your browser:

• Standard request metadata (IP address, user-agent, referer)
• Browser-fingerprint signals (the unique-ish combination of your browser version, screen size, installed fonts, and similar device characteristics that, together, look enough like a specific browser to tell humans apart from automated scripts) — Cloudflare uses these to make its bot/human determination

What Cloudflare does with that data:

• Cloudflare's stated purpose is bot detection. Cloudflare publishes its own privacy practices at cloudflare.com/privacypolicy.

Where the data goes:

• Cloudflare's infrastructure is global; some of your bot-evaluation data may be processed outside the United States. See our Privacy Policy Section 11 for the broader cross-border data-transfer framing.

Can I opt out?

• The __cf_bm cookie is part of GridBlitz's essential security posture — it prevents automated account-creation attacks and automated abuse of our email sign-in links and password resets, which would compromise other Users' safety. Disabling it would mean we cannot reliably tell those requests apart from an automated attack, so we treat it as essential per Section 4.1.
• If you need to use GridBlitz with bot-protection cookies disabled (for example, due to a compatibility issue with a privacy-focused browser), contact us via Section 10 and we will work with you on an alternative.

6.2 No Other Third-Party Cookies

We do not currently use any other third-party cookies — no advertising networks, no social-media platforms, no analytics providers, no third-party tools that would set cookies on your device. If we add a third-party service that sets cookies in a future release, this Section will be updated and (if the service's cookies fall outside the essential category) a consent banner will deploy per Section 5.

7. Your Cookie Choices

You have several ways to manage cookies on GridBlitz today and in future releases.

Quick reference — 4 ways to manage cookies:

• §7.1 Browser-level controls — what your browser already lets you do today (reject all / reject third-party / clear after session / private mode)
• §7.2 Browser-specific help — direct settings paths for Chrome / Safari / Firefox / Edge / mobile
• §7.3 GridBlitz Account Settings — kicks in once a consent banner deploys per §5; until then, there are no non-essential cookies to opt out of
• §7.4 Do Not Track signal — currently no additional effect since GridBlitz uses no tracking cookies

7.1 Browser-Level Controls

Every modern browser provides controls for cookies. We know some Users want maximum privacy; the trade-offs below are real and not your fault. You can:

• Reject all cookies — your browser settings can be configured to refuse all cookies, including essential ones. Doing this will break your ability to sign in to GridBlitz, because the sign-in mechanism depends on the essential cookies in Section 4.1. If you cannot tolerate any cookies, GridBlitz is not currently usable for you — and that is an honest limitation, not a workaround we are withholding.
• Reject only third-party cookies — many browsers offer this as a default privacy setting. On GridBlitz this would block the __cf_bm Cloudflare bot-protection cookie. Creating an account, requesting an email sign-in link, or resetting your password may become slower or fail in some browsers (Cloudflare may fall back to a full CAPTCHA challenge). Signing in with your password is unaffected.
• Delete cookies after each session — you can configure your browser to discard cookies when you close it. On GridBlitz this means you will need to sign in again on your next visit, but the Platform will otherwise function normally.
• Use private / incognito mode — these are the same feature under different browser names (Chrome calls it "Incognito"; Firefox and Safari call it "Private"; Edge calls it "InPrivate"). All of them discard cookies when the window closes. Same effect as the previous bullet.

7.2 Browser-Specific Help

Each browser provides its own cookie-control documentation:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Safari: Preferences → Privacy → Manage Website Data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Edge: Settings → Cookies and site permissions → Cookies and site data
• Mobile browsers: Settings vary; consult your browser's documentation

7.3 GridBlitz Account Settings

When a consent banner is deployed per the forward commitment in Section 5, you will be able to change your cookie preferences at any time via Account Settings → Privacy → Cookie Preferences. Until the banner is deployed, there are no non-essential cookies for you to consent to (per Sections 4.3 and 4.4).

7.4 Do Not Track

Some browsers send a "Do Not Track" signal with every request. GridBlitz does not use tracking cookies (per Sections 4.3 and 4.4), so the Do Not Track signal has no additional effect on what we do — there is nothing to opt out of beyond the essential cookies, which you can refuse via browser settings as described in Section 7.1.

8. Cookies and Your Privacy Rights

This Cookie Policy describes the cookies GridBlitz uses. The broader question of how we handle your personal data — including data that may be associated with the cookies in Section 4 — is governed by the GridBlitz Privacy Policy. See:

• Privacy Policy Section 2.3 — Session information (the data tied to the better-auth.session_token cookie)
• Privacy Policy Section 5.8 — Cloudflare Turnstile vendor disclosure (the __cf_bm cookie's data-handling)
• Privacy Policy Section 7 — Your Privacy Rights (CCPA, GDPR, and other jurisdictions)
• Privacy Policy Section 11 — International Users and cross-border data transfers (applies to Cloudflare's global infrastructure)

If you believe a cookie used on GridBlitz violates your privacy rights, contact us via Section 10 and we will respond per the Privacy Policy Section 7.4 procedure.

9. Changes to This Policy

GridBlitz may update this Cookie Policy over time — adding new cookies, removing cookies that are no longer used, complying with new laws, or clarifying existing language. When we make a material change — a change that introduces a new cookie category, a new third-party cookie, or otherwise meaningfully affects what cookies are set and why — we will notify Users at least (to be finalized before launch) before the changes take effect, by:

• Email to the email address on file with your Account, AND/OR
• An in-app banner or notification on next sign-in

If you do not agree with a material change, your options are: (a) stop using the Platform before the effective date, or (b) request Account deletion per the Privacy Policy Section 8.

Non-material changes (e.g., typo corrections, clarifications, updates to browser-help links) take effect immediately and are recorded in the changelog at the top of this document.

Each version of this Policy is preserved with its effective date. You may request the current and historical versions from GridBlitz at any time per Section 10.

10. Contact Information

Cookie questions, requests, complaints, or general inquiries about this Cookie Policy may be directed to:

• Operating Entity: (to be finalized before launch)
• Privacy Contact / Email: (to be finalized before launch)
• Mailing Address: (to be finalized before launch)

For Account-level questions (sign-in problems, billing, general support), use the support channel reachable from within the Platform. For data-rights requests under CCPA / GDPR, follow the Privacy Policy Section 7.4 procedure.

11. Standard Clauses

What this section covers (plain English): four standard housekeeping commitments that every legal document carries — what happens if a court strikes down part of this policy, whether our not enforcing something means we've waived it forever, whether we can transfer this policy to another company, and which state's law governs disputes about it. These mirror the same four clauses in our Terms of Service (Section 14) and Privacy Policy (Section 15).

• Severability — Plain English: if a court or regulator strikes down any provision of this Cookie Policy, the rest stays in effect to the maximum extent permitted by applicable law.
• No waiver — Plain English: our failure to enforce any provision of this Cookie Policy is not a waiver of that or any other provision. Letting something slide once isn't permanent permission.
• Assignment — Plain English: you can't hand off your rights or obligations under this Cookie Policy without our written OK. GridBlitz can transfer this Policy as part of a merger, acquisition, or sale of assets (a standard SaaS provision; see Privacy Policy Section 4.4).
• Governing law and dispute resolution — Plain English: disputes about this Cookie Policy are governed by the same law and resolved through the same mechanism as the GridBlitz Terms of Service (see Terms Section 12). (to be finalized before launch)

Appendix A — Required Disclosures Summary

The following disclosures are made consistent with the GridBlitz LEGAL_COMPLIANCE_FRAMEWORK_v1.md governance authority:

1. Platform Classification (per CLAUDE.md §1 + LEGAL §1). GridBlitz is a SaaS coordination platform, not a gambling platform, betting service, financial intermediary, or prize authority. Cookies on the Platform exist to support that classification (authentication + abuse prevention), not to support advertising or behavioral tracking.
2. No Sale of Personal Data (per CCPA + general commitment; mirrors Privacy Appendix A item 3). GridBlitz does not sell User personal data through cookies or any other mechanism.
3. No Advertising Trackers (per Section 4.4). GridBlitz does not use third-party advertising trackers, behavioral analytics that fingerprint Users, or social-media pixels.
4. Essential Cookies Disclosure (per ePrivacy Directive Article 5(3)). Essential cookies are disclosed in Section 4.1 with named-cookie inventory; they do not require User consent because they are necessary for delivering the Platform.
5. Forward Commitment to Consent Banner (per Section 5). Non-essential cookies will not be deployed without first implementing a User-facing consent mechanism. This commitment exceeds US federal law's strict requirements.
6. Cloudflare Turnstile Third-Party Disclosure (per Section 6.1). The one third-party cookie used on the Platform (__cf_bm) is disclosed by name, by purpose, and by data-handling boundary.
7. Cross-Reference to Privacy Policy (per Section 8). Cookies that store or relate to personal data are governed by the Privacy Policy for handling, retention, and User rights; this Cookie Policy is the focused cookie-specific disclosure.
8. Material-Change Notification (per Section 9 + LEGAL §13 + PRD §44 Versioning paragraph). Material changes to the cookies used trigger User notification under the same mechanism as Terms and Privacy Policy changes.

Appendix B — Definitions Cross-Reference

For convenience, key terms used in this Cookie Policy and where they live:

• GridBlitz / Platform / we / us / our — see Terms Section 2 + this Cookie Policy header
• You / your / User — see Terms Section 2
• Account — see Terms Section 2
• Cookie / First-party cookie / Third-party cookie / Session cookie / Persistent cookie / HttpOnly / Secure / SameSite — see Section 2 above
• Essential / Functional / Analytics / Advertising cookies — see Section 2 above + Section 4 inventory
• ePrivacy Directive — see Section 2 above (EU cookie-specific law)
• GDPR — see Section 2 above (EU privacy law); also see Privacy Policy Section 7.3
• CCPA — see Privacy Policy Section 7.2
• Consent banner — see Section 2 above (forward-commit in Section 5)
• Audit log — see Privacy Policy Section 2.6 (internal append-only record; not a cookie)
• Session token — the cookie value stored in better-auth.session_token; see Section 4.1