Cookies

Essential (always on)

These keep you signed in and make sign-up work. Without them the site can't work, so the law doesn't need your consent for them.

• sb-…-auth-token (may be split into .0, .1)Keeps you signed in. Set by Supabase, our sign-in provider.Until you log out, or up to 400 days
• dh_joinRemembers your sign-up choices (18+, picks emails, who invited you) between asking for a code and entering it.1 hour
• dh_picks_viewRemembers whether you last looked at your picks as tickets or as a list.1 year
• dh_consentRemembers what you chose on the cookie banner (analytics, marketing, both or neither), so we don't ask every time.6 months

Analytics (only if you allow them)

PostHog, hosted in the EU (Germany), tells us which pages help people and where they give up. It loads only if you allow analytics. It doesn't record your screen, never sees what you type, and knows you only by a random player number, never your name or email. Change your mind any time with "Cookie settings" at the bottom of every page.

• ph_<key>_posthog (cookie and browser storage)A random id so PostHog can count visits and steps without knowing who you are.1 year, or until you press Reject

Marketing (only if you allow them)

Meta's pixel tells Meta (Facebook and Instagram) when one of our ads brought someone to DrawHawk and when they made an account, so Meta shows our ads to fewer people who won't want them. It loads only if you allow marketing, sends only page views and sign-ups (never what you type or click), and we switch off Meta's automatic extras. When you make an account, and when your email is confirmed, we also tell Meta from our server, with a scrambled (hashed) copy of your email. Change your mind any time with "Cookie settings" at the bottom of every page.

• _fbpMeta's random browser id, so Meta can link a sign-up to an ad it showed.90 days
• _fbcOnly if you came from one of our ads: the ad click code Meta added to the link.90 days
• dh_meta_regOurs. Holds the sign-up's event number for a moment, so Meta counts your sign-up once, not twice.10 minutes

Not cookies, but worth knowing

• The bot check on the sign-up and log-in forms (Cloudflare Turnstile) doesn't set cookies. It checks your browser isn't a robot.
• Browser storage: only PostHog's copy of its random id (above), and only if you allow analytics.
• Error reports (Sentry, EU): if a page breaks, we get a report of what went wrong, with emails, codes and links stripped out. It sets no cookies and doesn't track you, so it runs without asking.
• Competition sites you visit through our links set their own cookies. Their cookie notices cover those.