Cookie Policy
1. What we use
First-party cookies for authentication and abuse investigation:
- `__Host-bk_device` — A first-party HttpOnly device-environment cookie also links accounts used in the same browser or app cookie storage for abuse investigation. The cookie expires 90 days after its last use; associations expire 90 days after their last observation and are periodically removed. It is not used for advertising or as proof of a physical device or human identity.
- `session` — keeps you signed in. It is dropped after 90 days of inactivity; opening the app resets that inactivity window. A one-year absolute limit still requires periodic re-authentication even for continuously active sessions. HttpOnly, SameSite=Lax, and Secure when served over production HTTPS.
2. What we do not use
No advertising cookies. No social-media pixels. We avoid third-party tracking cookies on the marketing site.
3. Local storage
The H5 app may use local storage for session pointers, room code hints, language, UI preferences, and a first-party telemetry anonymous id. For entry measurement, the marketing site classifies known sources such as ChatGPT, other referrals, internal navigation or direct/unknown traffic, distinguishing referrer signals from source tags. This measurement does not retain raw referring URLs, conversation content or query parameters. The marketing site stores its own origin-scoped anonymous telemetry id so aggregate visits, page views, clicks on links and buttons (recorded as fixed page-section and control labels, never the text you see or type) and which page sections were shown can appear in internal reports. It is not used for advertising or cross-site tracking. Hand history and review data are served from the backend, not from a marketing-site cookie.
4. Contact
Cookie questions: loong@bluffking.ai.