Cookies

A tracker is only justified by a service it renders. So we set just three families: what signs you in, what remembers a display preference, and what measures site usage when that measurement is enabled. To those are added the cookies set by two third parties we call on specific pages, listed here because they count as much as ours.

When you sign in, the authentication library sets a session cookie, named better-auth.session_token in its default configuration, which we have not changed. It is signed, scoped to the domain, inaccessible to page JavaScript, and sent over a secure connection in production. It is what keeps you authenticated: without it, the dashboard cannot work. It disappears on sign out or when the session lapses.

When you switch language, the selector writes a NEXT_LOCALE cookie valid for one year, across the whole site, in same-site lax mode. It contains only two letters, fr or en, and serves solely to bring the site back in the right language. It identifies nobody and is never passed to a third party.

The choice between light and dark theme is kept in your browser's local storage, not in a cookie. It is therefore never sent to the server with your requests, and it does not leave your machine. Clearing it means clearing the site's local storage from your browser settings.

The site can embed PostHog to understand which features actually get used. This measurement only activates if a key is configured on the environment, and stays entirely inert otherwise. When active, here is exactly the configuration chosen.

• The default hosting is PostHog's European cloud.
• Automatic page capture is disabled; a view is sent explicitly on each route change.
• No visitor profile is built for an unidentified person: person tracking is reserved to signed-in accounts.
• PostHog sets its own cookies to recognise a visit from one page to the next.
• Session replay is not enabled.

On the sign-in and sign-up forms, we load Cloudflare's Turnstile widget to tell a human from a bot and protect accounts from automated attacks. That widget loads a script from a Cloudflare domain and may set its own technical cookies, under Cloudflare's control. It loads only if a site key is configured, and appears on no other page.

Payment does not happen on our site: you are redirected to a page hosted by Stripe. The cookies set there are Stripe's, on its domain, and fall under its own policy. We have no access to them and we set no payment cookie of our own.

Better said plainly than left to be discovered: the site currently shows no consent banner, and no prior refusal mechanism is implemented. The non-strictly-necessary trackers described above therefore load as soon as they are configured on the environment. The way to refuse them remains, for now, your browser settings. Whether prior consent is required for those trackers, and in what form, must be settled by a lawyer under each applicable law, and this page will be corrected accordingly.

No ad network, no social media pixel, no sale or sharing of your browsing data for commercial purposes, no cross-site tracking, no advertising profiling, no session replay.

Every browser lets you block or clear a site's cookies from its privacy settings, and clear its local storage. Refusing the session cookie simply prevents signing in to the dashboard, since there is no other way to recognise you. Refusing the others has no consequence on how the service works.

Players on your Minecraft server do not visit this site and receive no cookie from us: game data arrives through the plugin installed on your server, not through a browser. How that data is handled is described in the privacy policy and on the GDPR page.

Any question about this site's trackers can be sent to contact@minealyze.com.