Cookie policy
Published By FizzPoker
FizzPoker uses a handful of cookies and browser-storage entries to run the game — none of them tracks you across other sites. Two optional statistics tools, Google Analytics and Ahrefs, load only if you say yes in the banner, and you can change that answer here at any time.
1. Your analytics choice
Declining stops Google Analytics and Ahrefs from loading and removes the Google cookies from this browser. The choice is stored in the fz_consent cookie for 12 months; clearing your cookies asks the question again. Outside the production site (previews, local builds) no third-party script ever loads and no banner is shown.
2. Strictly necessary — no consent needed
These entries are required to provide the service you asked for (§25(2) TDDDG, Art. 6(1)(b) and (f) GDPR): to keep your seat at a table, to keep you signed in, to remember your own settings. They stay in your browser and are described in the privacy policy.
| Name | Type | What it is for | Lifetime |
|---|---|---|---|
device_token | Cookie | Random token that identifies your browser as a player, so your seat survives a reload and your guest games can later be attached to your account. HttpOnly, Secure. | 12 months from the last visit |
device_token | Local storage | The same token, readable by the page so it can present it to the game server when a table opens. | Until you clear site data |
sb-iiueauxnpqdpescbkinu-auth-token (may be split into …-auth-token.0, .1) | Cookie | Your signed-in session (Supabase Auth). Only set after you sign in with an emailed link. HttpOnly, Secure. | Refreshed while you use the site; removed when you sign out |
sb-iiueauxnpqdpescbkinu-auth-token-code-verifier | Cookie | One-time secret that proves the browser that asked for a sign-in link is the one that opens it. | Minutes, during sign-in |
post_auth_next | Cookie | Where to return after signing in from a league invitation. HttpOnly. | 1 hour |
auth_event | Cookie | Carries "sign_up" or "login" from the sign-in link to the next page, once, so the event can be counted. | 5 minutes |
fz_consent | Cookie | Your answer to the analytics banner ("granted" or "denied"), so you are not asked on every page. | 12 months |
display_name | Local storage | The player name you typed last, pre-filled at the next table. | Until you clear site data |
app_user_id | Local storage | Your account id, so pages can show account features without a server call. | Until you sign out or clear site data |
fizz_theme | Local storage | Your display settings: theme, high-legibility mode, reduced motion, screen effects. | Until you clear site data |
home_audio_muted | Local storage | Whether you muted the start-screen sound. | Until you clear site data |
avatar_preset | Local storage | The drawn picture you picked as a guest. | Until you clear site data |
first_touch | Local storage | The page you first arrived from (referrer and any campaign tag), attached once to the sign-up event in our own statistics. | Until you clear site data |
sw_app_version | Local storage | The app version the installed web app last ran, to detect updates of the offline shell. | Until you clear site data |
fizz-shell-v1 | Cache storage | The app shell (scripts, styles, fonts, icons) cached by the service worker so the app opens instantly. Never game data. | Replaced on each app update |
3. Only with your consent — visitor statistics
Loaded only after you accept them in the banner (Art. 6(1)(a) GDPR, §25(1) TDDDG). What the two services receive and where it goes is described in the privacy policy, section 9.
| Name | Type | What it is for | Lifetime |
|---|---|---|---|
_ga | Cookie | Google Analytics 4: a pseudonymous client id to tell visits apart. Set by Google on .fizzpoker.com. | 2 years |
_ga_<property id> | Cookie | Google Analytics 4: keeps the session state. Set by Google on .fizzpoker.com. | 2 years |
(none) | Cookie | Ahrefs Web Analytics sets no cookie and stores nothing in your browser; it only sends page views. | — |
4. Managing cookies in your browser
Every browser lets you view, block and delete cookies and site data in its settings; blocking the strictly necessary ones means a table cannot remember your seat and sign-in does not work. Our own usage statistics (privacy policy, section 8) set no cookie of their own: they use a one-way hash of the device token the game needs anyway.