Cookies
Effective: 2026-05-15
1. What this page covers
This page lists every cookie and similar browser-storage mechanism
MatViz uses — including cookies, localStorage entries, IndexedDB
stores, and Service Worker caches — what each is for, and how long it
lasts. It supplements Section 6 of the Privacy Policy.
MatViz registers a Service Worker (/sw.js) that caches request and
response pairs locally on your device so the app remains usable on a
flaky tournament-venue network. These caches stay on your device, are
not transmitted to MatViz or any third party, do not carry tracking
identifiers, and can be cleared at any time from your browser's
site-data settings.
2. Strictly necessary cookies (always set)
| Name | Purpose | Lifetime | Attributes |
|---|---|---|---|
user_token | Session cookie set after login. | Session-scoped (cleared on logout). | HTTP-only, Secure, SameSite=Strict. |
session_token | Short-lived in-tournament scoring role cookie. | Per-tournament session. | HTTP-only, Secure, SameSite=Strict. |
csrf_token | Paired with state-changing requests as a CSRF defense. | Session. | Secure, SameSite=Strict. |
These cookies are essential for the Service to function and are exempt from consent under GDPR Art. 5(3) ePrivacy and equivalent U.S. state statutes.
3. Functional cookies (always set)
| Name | Purpose | Lifetime |
|---|---|---|
| Profile-visibility preference | Remembers your default profile-visibility setting (public/private). | 1 year. |
| Scoreboard layout preference | Remembers your preferred in-match scoreboard layout. | 1 year. |
Functional cookies are first-party, not used for cross-site tracking, and not shared with third parties. Although these preferences are first-party and not used for tracking, EU users will be offered a consent choice for them when the consent banner ships per §4 below.
4. Analytics cookies (NOT set today)
MatViz does NOT currently use any third-party web-analytics provider. If we add one (e.g., a privacy-respecting analytics SDK such as Plausible or PostHog), we will:
- Update Section 6 of the Privacy Policy listing the SDK and its data flow.
- Display a cookie-consent banner on your next visit (or on this page load, whichever comes first).
- Honor your "Essential only" choice by not loading the analytics SDK at all — not just suppressing its cookie writes.
5. Marketing / advertising cookies (NOT set today, NOT planned)
MatViz does NOT use third-party advertising cookies, retargeting pixels, session-replay tools, or browser fingerprinting libraries, and has no present plan to. If that ever changes, the consent banner described in Section 4 will gate any such cookie before it loads.
6. The cookie_consent choice cookie
When and only when an analytics or marketing cookie is in scope, MatViz
also sets a single first-party cookie named cookie_consent that
records your choice (Accept all / Essential only / Customize). It is
first-party, Path=/, Max-Age=31536000 (1 year), SameSite=Lax,
Secure in production. It is NOT HTTP-only because the in-page banner
must read it to suppress re-display. This cookie is itself essential to
MatViz honoring your choice and is exempt from consent.
7. How to change your choice
When the consent banner is active, you can change your choice at any
time by clearing your cookie_consent cookie in your browser settings
or by visiting your account settings page (link will be added when
analytics ships). Changing from "Accept all" back to "Essential only"
takes effect on the next page load: any already-loaded analytics SDK
will not transmit further data, and its cookies will be expired.
8. Contact
Questions: hello@matviz.com.