Cookies and browser storage
Last reviewed 2026-10-26.
This page lists everything Rolegend stores in your browser. It covers browser storage as well as cookies, because the rules that apply here cover both, and a list of only cookies would be an incomplete answer.
Most of it is the machinery of being signed in and of remembering settings you chose yourself, and none of that is used to build a profile of you or shared with anyone. 5 things on this list are different, and we ask before storing them: remembers which first-time hints on the play screen you closed, so each one shows once. analytics: which features get used, and whether a visit is a returning one. set by posthog, and only after you accept. ads: tells google ads that a visit or a sign-up came from one of our ads. set by google, and only after you accept ads. ads: tells meta (facebook and instagram) that a visit or a sign-up came from one of our ads. set by meta, and only after you accept ads. ads: tells tiktok that a visit or a sign-up came from one of our ads. set by tiktok, and only after you accept ads.
What we store
| Name | Type | What it is for | How long | Needs consent |
|---|---|---|---|---|
sb-<project>-auth-token | Cookie | Keeps you signed in. Without it every page would ask you to sign in again. | Until you sign out, or the session expires | No |
sidebar_state | Cookie | Remembers whether you collapsed the navigation sidebar, so it stays as you left it. | 7 days | No |
rolegend_age_attestation | Cookie | Carries your confirmation that you are 18 or over from the sign-in button to the sign-in service and back. Written only when you press one, and cleared as soon as you arrive. | 10 minutes, or until sign-in finishes | No |
rolegend_consent | Cookie | Records the choices you made about analytics and ads, so you are not asked again, including when you move between the main site and the app. | 6 months | No |
rolegend:dice-animation | Browser storage | Remembers whether you turned the 3D dice tray off. | Until you clear site data | No |
rolegend.install-prompt-dismissed | Browser storage | Hides the install prompt after you dismiss it. | Until you clear site data | No |
rolegend:play-hints-dismissed | Browser storage | Remembers which first-time hints on the play screen you closed, so each one shows once. | Until you clear site data | Yes |
ph_<key>_posthog and related | Cookie | Analytics: which features get used, and whether a visit is a returning one. Set by PostHog, and only after you accept. | Up to 12 months | Yes |
_gcl_au | Cookie | Ads: tells Google Ads that a visit or a sign-up came from one of our ads. Set by Google, and only after you accept ads. | 90 days | Yes |
_fbp | Cookie | Ads: tells Meta (Facebook and Instagram) that a visit or a sign-up came from one of our ads. Set by Meta, and only after you accept ads. | 90 days | Yes |
_ttp | Cookie | Ads: tells TikTok that a visit or a sign-up came from one of our ads. Set by TikTok, and only after you accept ads. | 13 months | Yes |
__cf_bm and _cfuvid, on challenges.cloudflare.com | Cookie | Set by Cloudflare while the 'are you a person' check runs on the early access form. They are how that check tells one visitor from another for the few seconds it takes. Only on that one page. | Up to 30 minutes | No |
Your choices
The banner asks once for both purposes. Here you can choose each one on its own, and change your answer at any time.
Which pages get used. Set by PostHog.
Whether our ads work. Set by Google, Meta and TikTok.
If you decline analytics, the analytics code still counts the visit, but in cookieless mode: it writes no cookie, no local storage and no session storage, and keeps no identifier for you. Our analytics provider derives a short-lived hash from the request in place of an identifier, and that hash changes every day, so a visit cannot be tied to the next day’s. We rely on legitimate interests to count visits this way.
If you accept analytics, we also build click and scroll maps of the public pages, so we can see whether people reach the part of the page that answers their question. That records where on a page you clicked and how far you scrolled. It does not record the page’s contents or anything you type.
If you accept ads, the Google Ads, Meta and TikTok pixels load. They tell each platform that a visit, an early access signup, a new account, the start of a checkout or a subscription came from one of our ads, so we can see which ads work. For a subscription, each platform also receives the price. Each platform receives the page address and its own cookie identifier, and handles that data under its own privacy policy. When you join the early access list, create an account, start a checkout or subscribe, we also tell Meta and TikTok, with your email address in hashed form, so a blocked pixel does not hide the result. Google receives the hashed address from its pixel. If you decline, no pixel loads and we tell no one.
Things we count without cookies
Separately from the choice above, we count what accounts do inside the game: an account was created, a character was made, a turn was played, a subscription started or ended. This does not read from or write to your device, so it is not a cookie question and the banner does not govern it. We rely on legitimate interests to understand whether the product works, and we send those counts to the same analytics provider listed in our sub-processors.
What is sent is the event itself, your account’s internal identifier, and structured details such as which plan was chosen or how long a turn took. Your campaign text is never part of it.
When you create an account, the campaign tags in the link you arrived from are stored with your account and sent with the account-created count. These are the utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid, ref values of that link, the page of this site where you pressed the button, and the name of the site that sent you, if there was one. They travel in the link itself, not in your browser, and we keep only the ones from the visit that created the account.
What we do not do
- No ad pixel before you accept ads.
- No session recording. We do not record your screen or what you type.
- Nothing you write in a campaign is used to identify you or sent to an analytics tool.