Cookies

We use functional cookies for Supabase admin authentication, HMAC character portal sessions, language preference, and basic application protection. These cookies are necessary for the service to work.

Known first-party cookies include etersystem-locale for up to 1 year, etersystem-active-rpg for up to 1 year, portal_session for up to 7 days, and Supabase Auth session cookies according to the admin session. They are used for language, active campaign, portal access, and admin login.

The browser may store functional preferences such as theme, interface density, language, active campaign, navigation state, and editable portal values when applicable. Examples include etersystem-locale, etersystem-active-rpg, etersystem-theme, and local interface keys.

Session Mode mirrors the running table’s state in the browser’s sessionStorage, per RPG. The browser clears that storage when the tab closes, and it is never sent to the server.

Vercel Analytics may collect aggregated navigation and performance metrics, including which button on the landing page a visit converted from. Those events carry only fixed labels defined in the code, never anything about the person. It does not require consent because it neither identifies you nor builds an advertising profile.

When you accept, we load the Meta Pixel (Facebook/Instagram) to measure how many people who arrived from an ad created an account, and to show ads to similar audiences. It writes third-party cookies on Meta domains and sends Meta the visited address, technical browser data, and the completed sign-up event. We do not send your name, your email, or the contents of your RPG campaigns.

None of it loads before your choice. If you decline, the script is never downloaded and no advertising cookie is created; if you accept, we store only your decision in the etersystem-consent cookie for up to 180 days. To change your mind, use Settings › Privacy if you have an account, or clear the cookies for this site and choose again.

Meta acts as an independent controller of the data it receives. Its processing is governed by its own privacy and cookie policies.

Under the same consent, we load PostHog to understand how the site is used: which screens are opened, which elements you click, where in a flow you give up, and whether an error appeared. This includes a recording of your session, in which every filled-in field is masked before it leaves your browser — we do not receive passwords, character sheet text, story text, or anything else you type.

The data is sent through our own domain, at etersystem.com/ingest, and processed by PostHog on servers in the United States, as a processor acting on our instructions. PostHog receives your IP address to estimate the approximate origin of the visit. If you have an account, we associate events with its internal identifier; never with your email or name.

As with advertising, none of it loads before your choice, and declining prevents the script from being downloaded.

Stories can render HTTPS images provided by admins. Those images load from the external domain and may expose technical data to that provider; the app uses no-referrer in known render paths.

Questions about cookies and functional storage: suporte@etersystem.com.