A cookie is a small file a site stores in your browser and reads back on your next request. Related technologies — local storage and session storage — do much the same thing without sending anything back to the server. This page covers both, and applies to thepicksproject.com.

How we handle personal information generally is described in our Privacy Policy.

All of these are strictly necessary: without them you cannot sign in, or sign-in becomes unsafe. None of them are used to profile you or to follow you to other sites.

Over HTTPS these carry the __Secure- or __Host- prefix — for example __Secure-next-auth.session-token — which instructs your browser to refuse them over an unencrypted connection. They are first-party cookies set by thepicksproject.com, and they are marked HttpOnly and SameSite=Lax so that scripts cannot read them and other sites cannot trigger them.

If you never visit a sign-in page, we set no cookies at all. Loading one sets the CSRF cookie even if you do not go on to sign in, because the protection has to be in place before the form is submitted, not after.

Your browser stores a couple of small preferences locally. These never leave your device and are not sent to our servers.

We use Vercel Web Analytics to see how many people visit which pages, and to count anonymous events such as "someone clicked create pool". It is worth being specific about what it does and does not do:

• It sets no cookies and writes nothing to your browser's storage.
• It does not build a profile of you, and it cannot follow you to any other site — the data is not shared across Vercel's customers.
• It does not store your IP address. Vercel derives a short-lived, non-reversible visitor hash for de-duplication and discards it within 24 hours.
• Nothing it records is linked to your account.

Details are in Vercel's analytics privacy documentation.

We embed no advertising networks, social media widgets, or embedded video players, so no third party sets cookies through our pages.

One exception is worth naming: when you click "Sign in with Google", you are sent to Google's own domain, where Google sets its own cookies under its own policy. That happens on Google's site, not ours, and is covered by Google's cookie policy.

Consent rules — the EU/UK ePrivacy rules and their equivalents — require you to be asked before a site stores anything on your device that is not strictly necessary to provide the service you requested. Every cookie we set is strictly necessary in exactly that sense: they authenticate you and protect the sign-in flow. Our analytics store nothing on your device, so there is nothing there to consent to either.

A banner that asks permission for things that need no permission trains people to click through consent prompts without reading them, so we would rather publish this page than show you one. If we ever add something that does need consent, we will ask for it properly before turning it on.

On our site

Signing out clears your session cookie. Deleting your account, from your profile page, removes the session records behind it as well.

In your browser

Every major browser lets you view, delete, and block cookies for a specific site, usually under Settings → Privacy. Be aware of the trade-off: because our cookies are the ones that keep you signed in, blocking them for this site means you will not be able to sign in or make picks.

If the cookies we use change, we will update this page and the date at the top of it. Questions about anything here: privacy@thepicksproject.com.