Cookie Policy

1. What cookies are

A cookie is a small piece of data a site asks your browser to store and send back with later requests. Without it a site cannot tell that two requests came from the same person.

Cookies are either necessary or optional. Necessary ones serve what the service cannot work without: sign-in, security, and remembering your choice. Optional ones cover everything else: statistics, advertising, tracking.

2. Cookies Synapse uses

The complete list. It is assembled from the code rather than from memory: names, durations and properties come from the same constants the cookies are set with.

synapse_session — category: necessary. Account sign-in. Holds an unpredictable session token; only its SHA-256 is stored in the database, so the cookie cannot be reconstructed from it. Duration: 8 hours, or 30 days with “remember me”. Properties: HttpOnly, SameSite=Lax, Secure in production, Path=/ — inaccessible to page scripts. Set by: lib/auth/session.ts.

synapse_guest — category: necessary. Stable guest identity: without it a player without an account would lose themselves in the room on every page transition. The same value lets the “online now” counter count one person once, however many tabs they open. A random identifier not tied to any person; issued on the first visit to any page and never stored in the database. Duration: 365 days. Properties: HttpOnly, SameSite=Lax, Secure in production, Path=/ — inaccessible to page scripts. Set by: proxy.ts.

synapse_cookie_preferences — category: necessary. Your own cookie choice and the version of the consent form. It is the opt-out mechanism itself: without it the site would forget your decision and ask again on every page. Contains no personal identifier. Duration: 365 days. Properties: HttpOnly, SameSite=Lax, Secure in production, Path=/ — inaccessible to page scripts. Set by: app/api/cookies/preferences/route.ts.

3. Shared properties

• HttpOnly — inaccessible to page scripts, so they cannot be stolen by injected script;
• SameSite=Lax — not sent when arriving from other sites;
• Secure in production — transmitted only over a secure connection;
• Path=/ — valid across the site.

4. What we do not have

Synapse has no analytics, statistics, advertising or marketing cookies. Google Analytics, Yandex.Metrica, Meta Pixel and similar systems appear neither in the code nor in the dependencies.

This is a deliberate decision: we do not collect user behaviour for dashboards.

There are also no third-party embeds — players, maps, widgets, font services — so no third-party cookies reach you through Synapse.

The content security policy forbids loading third-party scripts: even if someone inserted a tracker, the browser would not run it.

5. What the buttons do

The interface is in Russian; the labels are «Принять» (Accept), «Отклонить» (Reject) and «Настроить» (Customise).

«Принять» — consent to the optional categories: preferences, analytics and marketing. None of them is in use right now, so the button turns nothing on at this moment — it records your answer, and it will apply to such categories if they appear.

We say this plainly because it is what the button means: consent is given in advance and per category, not per script. You can change or withdraw it at any time — before anything starts, and after.

If the set of categories changes materially, your previous answer stops applying until you answer again: see section 8.

«Отклонить» — refusal of every optional category. No optional system starts and no optional cookie is set.

«Настроить» — a window with the categories. It shows only those actually in use; right now it shows plainly that there are none.

Both decision buttons are equally available and equally visible. Refusal is not hidden.

6. Why refusal does not delete necessary cookies

“Reject” means “reject everything optional”, not “delete all cookies”. Necessary cookies serve sign-in, security, guest mode, and the storage of your refusal itself.

If refusal deleted them, pressing “Reject” would sign you out, lose your identity in the room, and erase the memory of the refusal — the banner would return on the next page.

That is why necessary cookies are not presented as a choice: a switch that switches nothing is deception by interface.

7. Changing or withdrawing your decision

A “Cookie settings” link sits in the home page footer, in the legal section and in your profile settings. It opens the same window as the «Настроить» (Customise) button in the banner.

Permission given earlier can be withdrawn. On withdrawal the corresponding system stops being started, and the cookies of that category controlled by Synapse are deleted immediately — not “when they expire”.

Settings work without an account and remain available under any account restriction: this is a browser preference, not a service feature.

8. How your choice is stored

Your choice is stored in a first-party cookie on your device and contains only: the consent form version (currently 1), the state of the optional categories, and the date of the decision.

It holds no email, no name and no account identifier — a browser preference does not need them, and we do not record them.

Your choice is not an analytics event and goes nowhere except to this same site, so that the cookie can be set.

If the set of categories or their purpose changes materially, the consent form version will be raised and the banner will appear again: silently treating an old “yes” as an answer to a new question is not acceptable.

9. Browser storage

Besides cookies, Synapse keeps a little data in the browser itself. It is not sent to the server:

• tab identifier — to distinguish one person's tabs; disappears when the tab closes;
• player name — so a guest need not retype it in every room;
• the last selected pack — so you need not find it again when creating a game;
• an internal sign-in/sign-out message — so other tabs learn about the change; it contains the display name and stays in the browser until storage is cleared;
• the “reduce motion” setting.

10. Managing cookies in your browser

You can delete or block cookies in your browser settings. Account sign-in and guest play will then not work: there is no technical substitute for them.

Deleting the cookie holding your choice means the banner will ask again — the site simply stops remembering the answer.

11. If optional cookies appear

They will be off by default and will not start without explicit permission. The category will appear in the settings window, and this document and the consent form version will be updated before the first such cookie is set.

We do not widen the content security policy “in advance, for analytics”: while no concrete system exists, the restrictions stay strict.