The essentials
Kurz gesagt
We use __Host-col_sess to keep you logged in and, if you choose a language, col_lang to remember it. We do not use analytics, advertising or third-party cookies.
| Type | Do we use it? |
|---|---|
| Technical (necessary) cookies | Yes: __Host-col_sess, only if you sign up or log in, and a temporary cookie while you log in with Discord |
| Preference cookies | Yes, one: col_lang, only if you choose a language in the selector |
| Analytics or measurement cookies | No. We measure traffic without cookies (see below) |
| Advertising cookies | No |
| Third-party cookies | No |
What cookies are
Kurz gesagt
Small files a website stores in your browser. The law treats similar technologies, such as local storage, the same way.
Cookies are small files that a website stores in your browser to remember information between pages or between visits. Article 22(2) of the Spanish LSSI-CE also covers other technologies that store or read information on your device, such as the browser’s local and session storage (localStorage and sessionStorage). This policy tells you everything we store or read on your device, not just cookies.
The cookies we use
Kurz gesagt
They are all first-party. __Host-col_sess keeps you logged in; the two temporary ones protect logging in with Discord and keep your game code while you log in; col_lang remembers your language.
| Cookie | Owner | Purpose | Duration | Type |
|---|---|---|---|---|
__Host-col_sess |
First party (colonized.work) | Keep you logged in after you sign up or log in with Discord, so you do not have to log in again | 180 days from your last use: renewed while you use the website, and its code changes every 24 hours of use. Sessions with administration permissions expire after 12 hours without use and at most 180 days after logging in. Deleted when you log out, when you close it from “My account” or when you delete your account | Technical, strictly necessary |
__Host-col_oauth |
First party (colonized.work) | Protect logging in with Discord against forgery, by checking that Discord’s response matches your request. It is encrypted | At most 10 minutes; deleted when login finishes | Technical, strictly necessary |
__Host-col_vinc |
First party (colonized.work) | Only if you arrive from the game with your link code and are not logged in yet: keeps that code, encrypted, while you log in, to link your game account when you are back | At most 15 minutes; deleted when the account is linked | Technical, strictly necessary |
col_lang |
First party (colonized.work) | Remember the language you choose in the selector, to show you the website in that language | 365 days | Preference, chosen by you |
Technical details of __Host-col_sess: it contains a random code with no readable personal data. It is HttpOnly (page scripts cannot read it), Secure (only sent encrypted, over HTTPS) and SameSite=Lax (not sent from other websites on requests that change data). Our database only stores a cryptographic hash of that code. col_lang only contains the code of the chosen language.
If you just browse without logging in or changing the language, no cookie is created.
When you log in with Discord you go through discord.com, which has its own cookies and policies, like any other website you visit.
Storage in your browser
Kurz gesagt
Small notes that stay in your browser: your invitation code, the language notice you closed, your conversation with the Compi and whether you paused the animations, only during your visit; which Compi you chose and whether you put it to sleep; which 3D quality your device supports; if you ask, that we should not count your visits; and, while you are logged in, the address of your avatar for the header.
| Key | Type | Purpose | Duration |
|---|---|---|---|
col_ref |
Session storage, first party | Remember the invitation code from the link you arrived through, so it counts when you create your account | During your visit: deleted when you close the tab or complete sign-up |
col_lang_hint |
Session storage, first party | Remember that you closed the notice suggesting the website in another language, so it is not shown again | During your visit: deleted when you close the tab |
col_analytics_optout |
Local storage, first party | Remember that you asked us not to count your visits | Until you change it or clear your browser data |
col_compi |
Local storage, first party | Remember that you put the Compi (the website mascot) to sleep, so it does not come back until you wake it | Until you wake it or clear your browser data |
col_compi_chat |
Local storage, first party | Remember which Compi you chose in the chat, so it keeps you company around the website | Until you choose another or clear your browser data |
col_compi_chat_nolog |
Local storage, first party | Remember that you objected to us keeping your questions to the chat (“Don’t keep my questions” button) | Until you press “undo” or clear your browser data |
col_compi_chat_log |
Session storage, first party | Keep your conversation with the Compi in your browser, a random tab identifier (for usage limits) and, if needed, the anti-bot check pass. We do not keep the conversation on our server | During your visit: deleted when you close the tab (or with “Start over”) |
col_compi_* |
Session storage, first party | Remember that the Compi has already greeted you on a page, so the greeting is not repeated | During your visit: deleted when you close the tab |
col_x3d_paused |
Session storage, first party | Remember that you paused the website’s animations («Pause animations» button), so they stay paused when you change page | During your visit: deleted when you close the tab |
col_gpu |
Local storage, first party | Remember which 3D quality your device supports, so it does not have to be checked on every page (that check made the website slower to respond). It only stores the type of graphics card (for example, “integrated” or “dedicated”), whether the browser supports WebGL2 and two short, non-reversible codes that are only used to tell whether you changed browser or graphics card. It does not store the card model | 30 days, or until you clear your browser data |
col_avatar |
Local storage, first party | Show your Discord avatar in the header while you are logged in. It only stores the address of the image on our domain, with no other data | Until you log out or delete your account (it is also removed if the website detects you are no longer logged in) |
None of them is sent to our server automatically. The invitation code is only sent when you create your account, the avatar address when your browser requests the image from our domain, and your conversation with the Compi, trimmed, only when you send it a message (we do not keep it).
Cookie-free statistics
Kurz gesagt
We count visits without cookies and without storing your IP address. If you would rather not be counted, you can switch it off right here or use your browser’s privacy signal.
To learn which pages people find interesting and where visitors come from, we use our own statistics system, hosted on our EU server, which uses no cookies or any other storage on your device. It works like this:
- When you open a page, your browser sends us which page it is, the website you came from, the language and the screen width.
- Our server adds the approximate country provided by Cloudflare and works out the device type (mobile, tablet or desktop).
- To count unique visitors for that day, it calculates an identifier by mixing your IP address and your browser with a random daily key. It stores neither the IP address nor the browser.
- Each day’s key is destroyed after 48 hours: from then on, the identifier cannot be recalculated or linked to other days or to your account.
Only we see this data, always in aggregate (visits per page, referrers, countries and devices). It is not combined with your account, not shared with anyone and cannot be used to follow you across other websites. Records are kept for at most 25 months.
Your choices. We honour your browser’s Global Privacy Control and “Do Not Track” signals: if it sends them, we do not count your visits. You can also switch counting off in this browser:
Statistik in diesem Browser
Deine Besuche werden anonym und ohne Cookies gezählt.Deine Besuche von diesem Browser aus werden nicht gezählt.Dein Browser sendet das Signal „Global Privacy Control“, daher zählen wir deine Besuche nicht.Dein Browser sendet das Signal „Do Not Track“, daher zählen wir deine Besuche nicht.Dein Browser lässt nicht zu, dass wir diese Einstellung speichern. Du kannst stattdessen dessen Einstellung „Global Privacy Control“ oder „Do Not Track“ nutzen.Dieser Schalter benötigt JavaScript. Du kannst auch die Einstellung „Global Privacy Control“ oder „Do Not Track“ deines Browsers nutzen.
Cloudflare security cookies
Kurz gesagt
Cloudflare protects the website from attacks and, only when needed, may set a security cookie. It is not used to track you.
Cloudflare, our network provider, may set one of these cookies when its protections need to, for example when traffic looks automated:
| Cookie | Owner | Purpose | Duration | Type |
|---|---|---|---|---|
__cf_bm |
Cloudflare, on our behalf | Tell people apart from automated programs (bots) | 30 minutes of inactivity | Technical, security |
cf_clearance |
Cloudflare, on our behalf | Remember that you passed a security check, so you do not have to repeat it | As set by the protection (30 minutes by default) | Technical, security |
These cookies are strictly necessary to protect the service and are not used for advertising or to track you. Cloudflare explains them on its cookie page.
On some forms, such as the contact form or email sign-up and login, we may use Cloudflare’s bot check (Turnstile). It only loads on those forms and analyses technical signals from your browser and connection to tell people apart from bots; its sole purpose is to protect the form you are about to send.
Third-party content
Kurz gesagt
We do not embed videos, widgets or social buttons that set cookies. Links to Steam or Discord take you to their websites.
Right now we do not embed any third-party content that sets cookies or reads your device. Links to Steam, Discord or other networks take you to their own websites, which have their own cookie and privacy policies.
If we embed third-party content that uses cookies in the future, such as a video or the Steam store widget, it will not load until you activate it with a click, and we will add it to this policy beforehand.
Why you do not see a cookie banner
Kurz gesagt
Because we do not need one: the cookies we use are essential for what you ask for or remember something you choose, and our statistics do not use cookies.
The law requires your consent before using cookies that are not necessary, such as analytics or advertising cookies. Cookies that are strictly necessary to provide a service you have expressly requested are exempt (Article 22(2) LSSI-CE): keeping you logged in when you log in, protecting that login, remembering the language you choose in the selector or the invitation code from the link you followed to sign up.
As we do not use analytics, advertising or third-party cookies, and our statistics store nothing on your device and stay within what the Spanish Data Protection Agency considers exempt audience measurement, there is nothing to accept or reject. That is why we do not show you a banner. Even so, we explain everything here, for transparency.
How to delete or block cookies
Kurz gesagt
From your browser settings. If you block __Host-col_sess, you will not be able to log in.
You can view, delete or block cookies and browser storage from your browser settings:
If you block the technical cookies, the website will still work, but you will not be able to log in or apply for the alpha. If you block col_lang, you will have to choose your language on each visit.
Changes to this policy
Kurz gesagt
If we add any new cookie or technology, we will update this page before using it.
If we change the cookies or technologies we use, we will update this policy before doing so and change the date at the top. If we ever used cookies that require your consent, we would ask for it before setting them.
For any question, write to admin at colonized.work. We publish this policy in several languages; in case of any discrepancy between versions, the Spanish version prevails.
