Cookie Policy
1. What cookies are
Cookies are small text files a website stores on your device. Some are essential for a site to work — for example, to remember that you are signed in. Others are used for analytics or advertising; those require your consent, and this site does not use any.
2. Cookies we use
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
ipd_portal_session | Keeps you signed in to the player portal after you log in. It contains only a signed reference to your player account — no password and no personal details. | 30 days, or until you sign out | Strictly necessary |
ipd_guest_support | Keeps a guest-support conversation private after you open its emailed link. It contains a random access token; our database stores only its one-way hash. It cannot sign you in to a player account. | Up to 30 days, or until you sign out or revoke the link | Strictly necessary (security) |
authjs.session-token | Signs in members of our own support and administration team on the private admin area. It is never set for players. | Session | Strictly necessary |
_GRECAPTCHA (Google) | Set by Google reCAPTCHA when you use one of our sign-in, password or guest-support forms, to tell real people apart from automated attacks on player accounts and our support mailbox. It is a security measure, not advertising or analytics. | Up to 6 months | Strictly necessary (security) |
Our own three cookies are HttpOnly (JavaScript cannot read them), are sent only over HTTPS in production, and are restricted to this site with SameSite protection against cross-site misuse. The fourth is set by Google and is described in the next section.
We also store one small item in your browser's local storage to remember that you have seen the cookie notice, so it is not shown on every visit. It contains no personal data and is never sent to our servers.
3. Google reCAPTCHA
Our sign-in, password-reset, administrator and guest-support forms are protected by Google reCAPTCHA v3, which scores how likely a request is to come from a bot without showing you a puzzle. Google receives your IP address and information about how you interacted with the page in order to produce that score. We use this only to protect player accounts and to stop automated submissions and mass password-reset or support-link emails — never for advertising or profiling.
To keep this minimal, reCAPTCHA is not loaded on pages without such a form, and even on those pages it loads only once you start filling the form in. Google's processing is governed by its Privacy Policy and Terms of Service. We consider this strictly necessary for the security of the service; if you block it, sign-in may fail and you will be told why.
4. Google Sign-In
The sign-in page offers "Continue with Google" as an optional login method. To protect your privacy, Google's sign-in code is not loaded until you actually choose that option — until then no request is made to Google and no Google cookie is set. Once you choose it, Google may set its own cookies to complete the sign-in; that processing is governed by Google's Privacy Policy. If you prefer to avoid this entirely, sign in with your email address and password instead.
5. Embedded YouTube video
Our home page shows the official game trailer, hosted on YouTube. The trailer starts playing automatically, muted and on a loopwhen the home page opens, so the YouTube player is loaded as soon as you reach that part of the page. We embed it from YouTube's privacy-enhanced mode (youtube-nocookie.com), in which YouTube says it does not use your viewing of the video to personalize your YouTube or advertising experience. To play the video, YouTube receives your IP address and technical information about your browser, and it may store technical data in your browser (for example in local storage). This processing is carried out by Google and governed by Google's Privacy Policy. The trailer appears only on the home page; the other pages, including the player portal and these legal pages, do not load YouTube. You can block content from youtube-nocookie.com in your browser or with a content blocker without affecting anything else on this site.
6. Why we do not ask for cookie consent
Under the EU ePrivacy rules and equivalent national laws, consent is required for cookies that are not strictly necessary — typically analytics, profiling and advertising cookies. We set none of those ourselves, and security measures such as reCAPTCHA fall under the strictly necessary exemption, so we inform you instead of asking for consent. The embedded trailer described in section 5 is provided by YouTube in its privacy-enhanced mode and is the one exception to this. Strictly necessary cookies cannot be switched off without breaking sign-in, but you can browse all our public pages — including this one and the account deletion instructions — without them.
7. Managing cookies
You can delete or block cookies in your browser settings at any time. Blocking the cookies above means you will not be able to sign in to the player portal. Signing out from the portal deletes the session cookie immediately.
8. The game app does not use cookies
Cookies are a web technology. The Idle Planet Defendermobile app does not use them. The rewarded ads inside the game instead rely on your device's advertising identifier and, where required, on your consent, which you can change from Settings ▸ Advanced ▸ Ad Privacy in the game or in your device settings. That is described in section 4 of our Privacy Policy.
9. Changes and contact
If we ever add cookies that are not strictly necessary, we will update this page and ask for your consent before setting them. Questions? Write to [email protected], or read our Privacy Policy for the full picture of how we handle your data.