Cookie Policy
Last updated: 12 September 2026 · ePrivacy Directive / GDPR
1. What this policy covers
This Cookie Policy explains how shadowcity.app (“Shadow City”, “we”) uses cookies and similar technologies, what data they relate to, and how you can control them. It is part of our Privacy Policy and Terms of Service.
A cookie is a small text file stored on your device by a website. Similar technologies include session storage, local storage, and pixels. We use first-party cookies that we set, plus whatever cookies our infrastructure (Cloudflare) may set to protect the site. If you choose Accept all, we also load Google Analytics 4 (Google LLC) so we can see which public pages and in-game places are visited. We do not use advertising networks or social-media pixels. Analytics is off on battle screens and on Night Office.
By law, cookies that are strictly necessary to provide a service you requested (for example to log you in, to keep a form secure, or to remember that you answered the cookie banner) may be set without prior consent. All other cookies require consent. We show a banner so you can choose Necessary only or Accept all.
2. Disclaimers — please read
- We cannot operate the game without a session cookie once you log in or register. If you block all cookies, registration, captcha, and login will fail. That is a technical limit, not a punishment.
- Choosing “Necessary only” means we will not load Google Analytics or set optional cookies. The game still works.
- Choosing “Accept all” is your consent (GDPR art. 6(1)(a) and ePrivacy) to Google Analytics on this site. You can withdraw at any time by clearing the
sc_consent_v2cookie (the banner will ask again) or by writing to [email protected]. - Withdrawing consent does not make past processing unlawful.
- Third parties we do not control (your browser, extensions, school/work network, Cloudflare) may store their own data. We are not responsible for cookies we do not set.
- Google Fonts is loaded from Google’s servers. That is a network request, not a cookie we write. Google may process your IP address. If you do not want that, use a browser extension that blocks third-party fonts, knowing the site may look different.
- We do not use cookies to sell your data, to build a credit file, to infer special-category data, or to serve third-party ads.
- In-game marks, items, and ranks are not stored in cookies; they live in our database on your account.
- A “Do Not Track” browser signal is not yet a single legal standard; we honour the choice you make in our banner.
- If you are under 16 you must not use the Service; we do not seek cookie consent from children.
3. Cookies we set
| Name | Who | Type | How long | What it does |
|---|---|---|---|---|
PHPSESSID |
shadowcity.app (first party) | Strictly necessary | Session (until you close the browser or log out) | Keeps you logged in; holds a CSRF token so other sites cannot submit forms as you; holds the Night sigil captcha during registration; remembers the character you are playing. HttpOnly; Secure on HTTPS; SameSite=Lax. Not accessible to JavaScript. |
sc_consent_v2 |
shadowcity.app (first party) | Strictly necessary (stores your cookie choice) | Up to 12 months | Remembers whether you chose “Necessary only” or “Accept all” so we do not ask on every page. Values: necessary or all. Set only after you click the banner. Replaced sc_consent when Analytics was added, so we ask again. |
We may also use a brief server-side session store (not a marketing profile) for rate limits and captcha. That is not a cookie on your disk beyond PHPSESSID.
4. Cookies others may set
Cloudflare sits in front of the site. It may set cookies such as security or load-balancing cookies (for example cookies used to detect bots). Those cookies are governed by Cloudflare’s policies. They are used to deliver and protect the Service, not to advertise Shadow City products to you on other websites.
Google Fonts: no cookie is required for us to display the typeface, but Google may log the request.
Google Analytics 4 (only after “Accept all”). Google LLC may set cookies such as _ga and _ga_<container-id> (typically up to 2 years) to tell visits apart. We send the page path and title (for example /city/witches_quarter or /market), approximate country, and device/browser. We do not send your email, password, character name, chat, or inventory. Battle URLs are not sent. Google may process this in the United States; see the Privacy Policy on transfers.
We do not embed YouTube, Facebook, Twitter/X, TikTok, or advertising iframes on the front page or in the game chrome.
5. How data from cookies is used
- To authenticate you and keep your session.
- To stop cross-site request forgery on travel, fight, chat, and register forms.
- To run the captcha and reject automated sign-ups.
- To remember cookie consent.
- Together with IP address (not stored in the cookie itself) to apply security bans and rate limits — see the Privacy Policy.
- If you accepted all cookies: to count visits to public pages and in-game places (streets, shops, gym, apartment) via Google Analytics.
We do not combine cookies with purchased data broker lists. We do not run cross-site tracking. We do not use cookies for automated profiling that produces legal effects.
6. Legal bases
Strictly necessary cookies: ePrivacy exception for cookies that are necessary to provide a service you requested, plus GDPR art. 6(1)(b) (contract) and 6(1)(f) (security). Optional cookies: consent, art. 6(1)(a). You can refuse optional cookies without losing the core game, except that blocking all cookies including necessary ones will break login.
7. How to control cookies
- Use our banner: Necessary only / Accept all.
- Browser settings: block or delete cookies. Instructions differ by browser (Chrome, Firefox, Safari, Edge, etc.).
- Log out to end the session cookie on our side; then delete cookies in the browser if you want them gone locally.
- Email [email protected] if the banner does not work.
If you block cookies entirely, we cannot promise that forms, captcha, or “remember this device” behaviour will work.
8. Changes
If we add advertising or extra widgets, we will update this table and ask for consent again where the law requires it.