Cookie Policy.
Cookies have a bad reputation, mostly because the industry spent fifteen years using them in ways nobody asked for. The vast majority of what cookies do is mundane — keeping you logged in across page loads, remembering you prefer the dark theme, that sort of thing — but a smaller subset tracks behaviour for advertising or analytics, and that's the part everyone's been arguing about since GDPR landed.
This page explains exactly what we do at Kingmaker. Every cookie we set is listed below by name, with what it does, how long it lives, and what category it falls into. You can disable everything except the strictly necessary cookies — and we tell you, for each category, what happens to the experience if you do.
The four categories at a glance
We group cookies into four buckets, in order of how essential they are to the site working. The cookie banner that appeared on your first visit lets you toggle the last three; the first cannot be disabled because the platform genuinely cannot function without it.
How we ask for and record your consent
On your first visit a banner appears at the bottom of the screen asking which cookie categories you're comfortable with. The strictly-necessary category is on by default and cannot be turned off; everything else starts off and you can toggle it on. Your choices are stored in a cookie called km_consent which lasts 12 months — after that, we ask again.
You can change your mind at any time. The cookie preferences link in the footer reopens the banner, lets you toggle categories, and saves the new preferences. Disabling a category retroactively also deletes any cookies in that category that have already been set during the current session.
We honour the Global Privacy Control header where browsers send it. If your browser has GPC enabled, we treat it as an automatic opt-out from analytics and performance cookies, and the banner reflects that choice.
Third-party cookies (what other companies set)
When you load a Kingmaker page, your browser doesn't only talk to our servers. It also fetches things from a small number of third parties — fonts from Google, fraud protection from Cloudflare, analytics from Google Analytics 4, error logging from Sentry. Each of those third parties may set its own cookies on your device, separately from ours.
We've listed every third party that sets a cookie below. We've also disabled or restricted the more aggressive features of these services — for example, Google Analytics is configured with IP anonymisation enabled and ad-personalisation features turned off, so it cannot build a behavioural profile of you across other sites that use Google services.
The third parties we use are:
- Cloudflare — DDoS protection, content delivery, and bot-prevention. Sets a __cf_bm token used to identify automated traffic. Lifetime 30 minutes per page load.
- Google Fonts — serves the typefaces used on this website. Does not set cookies, but Google may log the IP address of the request. We use system fonts as fallback if Google Fonts is blocked at the network level.
- Google Analytics 4 — aggregated visit analytics. Sets _ga and related cookies for client identification. Configured with IP anonymisation, ad-personalisation off, and no cross-site behavioural tracking.
- Sentry — application error logging. Sets a session-level cookie to group errors from the same user session. Does not contain personally identifiable information.
- Stripe and other payment processors — load only when you reach the cashier page. Each sets its own cookies for fraud detection and session security; their cookie policies apply to the cashier flow.
Do Not Track and Global Privacy Control
Two browser-level mechanisms exist for telling websites you don't want to be tracked: Do Not Track (DNT), which has been around since 2009, and Global Privacy Control (GPC), which is newer and gaining regulatory traction.
We honour Global Privacy Control. If your browser sends a Sec-GPC: 1 header, we treat that as a binding opt-out from analytics and performance cookies, equivalent to you toggling those categories off in the cookie banner. The opt-out persists across sessions and you don't need to do anything else.
Do Not Track is a different story. The DNT spec was effectively abandoned by browser vendors and most websites stopped honouring it years ago because it had no legal teeth and no consistent meaning. We don't honour DNT specifically — but if you've enabled DNT, your browser almost certainly also sends GPC, which we do honour.
Specific uses we want to call out
A few cookie-related practices are worth flagging explicitly because they often show up in policies as one-line afterthoughts:
- We do not use cookies for behavioural advertising. We don't run ad campaigns that follow people around the internet, so we don't need the tracking pixels that enable them.
- We do not sell cookie data to data brokers. The phrase 'sale of personal information' has different definitions in different jurisdictions, and our practices wouldn't qualify under any of them.
- We do not use fingerprinting beyond what fraud-prevention requires. Cloudflare Turnstile examines a small set of browser characteristics during registration and login to distinguish humans from bots. The result is a yes/no signal, not a stored fingerprint.
- We do not place cookies before consent for non-essential categories. The only cookies set on first page load — before you've answered the banner — are the strictly-necessary ones (session, CSRF, locale).
How long cookies stick around
Cookie lifetime is set per cookie. Some are 'session cookies' that disappear the moment you close the browser; others are 'persistent cookies' with explicit expiry dates ranging from 30 minutes (fraud tokens) to 24 months (Google Analytics client ID).
The full inventory below shows the lifetime of every cookie we set. If you want to clear all of them immediately, every modern browser supports clearing cookies for a specific website — instructions for the major browsers are in the Browser Controls section near the bottom of this page.
Local storage and session storage entries do not have built-in expiry dates. We delete them when they're no longer needed (typically when you log out), and they're cleared by the same browser-level controls that clear cookies.
Changes to this policy
Cookie practices evolve as browsers, regulators, and platforms change what's possible. We update this page when we add a new category, change a third-party provider, or change the lifetime of an existing cookie. The 'last updated' and 'effective from' dates at the top tell you the current version.
Material changes — adding a new category of cookies, or changing the consent flow — are communicated to registered users by email at least 14 days before they take effect, and the cookie banner is automatically reopened on your next visit so you can review your preferences against the new categories. Smaller changes (clarifications, typo fixes) are made silently.
The full inventory
Every cookie we set, what it does, where it comes from, how long it lasts, and which category it falls under. Updated whenever we add, remove, or change a cookie.
How to clear or block cookies in your browser
Every modern browser lets you view, delete, and block cookies on a per-site basis. The links below are direct to each browser's documentation. Note that disabling all cookies will break your ability to log in to Kingmaker (and to most other websites that require accounts).