Cookies and Storage — jpgames.app

Effective: 2026-07-14

The complete list of what jpgames.app stores on your device to make the service work. Compare with the summary in PRIVACY.md at /privacy.

jpgames.app does not use ad networks, does not embed third-party analytics, and does not include third-party content that would set cookies on your device from other domains. So this list is the whole list — nothing else lands on your device from a visit to jpgames.app.

Browser localStorage

Kept per-browser, per-device. Cleared when you clear site data for jpgames.app in your browser.

jpgames.zoom

Your preferred zoom level — the percentage shown in the small zoombar in the top-right of every page. Persisted so your setting survives a reload or a return visit. Values 50–200. Default 100.

euchre.pid

A random 128-bit identifier that stands in as your player identity while you're playing as a guest. Server-signed with a rotating secret so the identity can't be forged by another visitor. Lets you close a tab and come back to your seat.

euchre.token

The signed HMAC token that pairs with euchre.pid above. The server uses these two together to reclaim your seat and prevent someone else from spoofing your player id.

euchre.name

The display name you typed on the Euchre home screen. Saved so you don't have to re-type it on future visits.

Session cookies (once accounts arrive)

Not present today. Added in the next release when username + password sign-in ships.

jpgames_session

A high-entropy random token identifying your signed-in session. Set HttpOnly, Secure, SameSite=Lax. The server stores only a hash of this value so a database dump can't resurrect live sessions. Expires 30 days from creation, rolling on activity.

jpgames_csrf

A short random token echoed back with state-changing form submissions (sign in, log out) as an anti-CSRF measure. Not HttpOnly because the client needs to read it and include it in the form.

Server-side, tied to your account (once accounts arrive)

Not stored on your device — kept on the server, in the same SQLite database as game state.

users row

  1. id — random 128-bit identifier
  2. handle_folded and handle_display — the name you sign in with
  3. password_hash — scrypt hash with a per-account salt. The raw password is never stored or logged.
  4. created_at, updated_at

sessions row

  1. id_hash — SHA-256 of the cookie value described above
  2. user_id — the account this session belongs to
  3. created_at, expires_at, last_seen
  4. user_agent — the User-Agent header from the browser you signed in with, for your own "log out everywhere" list later

What's not on this list

  1. No ad-network cookies. jpgames.app does not use AdSense, AdMob, Facebook Pixel, or any other ad or retargeting network.
  2. No analytics cookies. No Google Analytics, Plausible, Fathom, or similar.
  3. No social-widget cookies. No embedded like buttons, share widgets, or comment iframes.

Clearing everything

To disconnect from any past sessions:

  1. Sign out (once accounts exist) — deletes the server-side session row and clears the cookie.
  2. Clear site data for jpgames.app in your browser — removes both localStorage and any cookies. On next visit you'll get a fresh euchre.pid.

This list is written in good faith to describe how the service actually stores things. It is not legal advice. See PRIVACY.md at /privacy for the wider privacy story.

100%