Cookie Policy
Last updated: July 31, 2026 · Version 1.0.0
This page explains how Hack n Roll uses cookies. We keep cookie usage minimal: only what is required for authentication.
1. Overview
Hack n Roll uses a small number of strictly necessary cookies to keep you signed in. We do not use advertising cookies, third-party analytics cookies, or social media tracking pixels.
For broader information about how we handle personal data, see our Privacy Policy and Terms of Use.
2. Cookies We Use
The Platform currently sets two authentication cookies:
- access_token: a short-lived, strictly necessary cookie required for authentication. It authenticates API requests during your active session.
- refresh_token: a longer-lived, strictly necessary cookie required for authentication. It obtains a new access token without requiring you to sign in again.
These cookies are strictly necessary to provide authentication and core Platform functionality. Because they are essential, they cannot be disabled individually within the Platform. You may block them through your browser settings, but doing so will prevent you from signing in or staying signed in.
3. Cookie Properties
Both authentication cookies are configured with the following security properties:
- HttpOnly: not accessible to client-side JavaScript, reducing exposure to cross-site scripting attacks.
- SameSite=Lax: sent only on same-site requests and top-level navigations, providing baseline CSRF protection.
- Secure: in production, cookies are transmitted only over HTTPS.
4. What We Do Not Use
Hack n Roll does not set cookies for:
- Advertising or retargeting.
- Third-party analytics or behavioral tracking.
- Social media integrations or share buttons that track users.
- A/B testing or marketing campaigns.
Hack n Roll does not store authentication tokens in localStorage or sessionStorage.
Infrastructure providers such as Cloudflare may set their own cookies (for example, security or bot-management cookies) when traffic is routed through their services. Those cookies are outside Hack n Roll's direct control and are governed by the provider's own privacy documentation.
5. Managing Cookies
You can configure your browser to block or delete cookies. However, blocking authentication cookies will prevent you from signing in or staying signed in to Hack n Roll.
Signing out removes the authentication cookies from your browser and invalidates the associated refresh token on the server where applicable.
For questions about cookies or personal data, contact privacy@hacknroll.dev.
6. Changes to This Policy
We may update this Cookie Policy to reflect changes in authentication mechanisms, infrastructure providers, or legal requirements. Material changes will be reflected by updating the document version and "Last updated" date on this page.