Cookie Policy

Current use

The public website and Warp do not set advertising, analytics, profiling, or session-recording cookies. Fonts are served with the site. Normal browser caching may store public assets. To make pages load faster, your browser keeps the public list of Collapse games in session storage for up to ten minutes, which is scoped to the tab session. Your signed-in account summary is held in page memory and refreshed about once a minute; it is not written to persistent browser storage. Player search remembers your last six searches in local storage on your device only; clear it with your browser’s site data.

Sign-in and security cookies are set only by verify.collapseinitiative.com. The dashboard on www.collapseinitiative.com asks your browser to send them to verify.collapseinitiative.com when it loads your account. They are not shared with another company’s verification service.

Essential authentication cookies

__Host-collapse-flow: an opaque browser-binding value used during the requested Discord and Roblox authorization flow. Set when opening a valid verification link; maximum browser lifetime 10 minutes. The account-linking flow is bound to that browser only when the consent form is submitted. Secure, HttpOnly, SameSite=Lax, host-only, and unavailable to page JavaScript.

__Host-collapse-login: an opaque value that ties a Discord sign-in to the browser that started it. Set when you choose Sign in with Discord and cleared when you return; maximum lifetime 10 minutes. Secure, HttpOnly, SameSite=Lax, host-only, and unavailable to page JavaScript.

__Host-collapse-account: an opaque authenticated account-session value set after successful account linking or Discord sign-in. Maximum browser and server session lifetime one hour. Secure, HttpOnly, SameSite=Lax and host-only. Signing out invalidates the session and clears this cookie. The database stores a hash of the session value.

__Host-collapse-device: a random security value set when you sign in, create an account or verify. Lifetime one year. We store only a keyed hash of it with your account, to detect account takeover and accounts used to evade bans, as described in the Privacy Policy. Secure, HttpOnly, SameSite=Lax, host-only, and unavailable to page JavaScript. It is not used for advertising or analytics and is not shared with other sites.

These cookies are strictly necessary for the sign-in and account security you request. Refusing them prevents account verification or sign-in but does not prevent browsing the public website.

Payments

When you open the supporter payment form, Stripe loads its form from js.stripe.com and may set cookies such as __stripe_mid and __stripe_sid to prevent fraud. Stripe controls their purposes and lifetimes under its Cookie Policy at stripe.com/legal/cookies-policy. Its library remains loaded for the current page after a form closes, and persistent cookies can remain until expiry or deletion. Stripe may also use storage for payment authentication, including Link if you choose it. We do not use this storage for advertising.

Checkout session storage

The payment form stores a random checkout reference in session storage under a key beginning collapse-checkout:. It helps the server recognize a retry and avoid duplicate purchases; it contains no card number, billing address or phone number. It is removed after the form reports successful confirmation, or when the browser ends the tab session. Closing a form does not necessarily cancel a payment already processing.

Infrastructure and other websites

Cloudflare may set security cookies when its challenge or bot-protection features are invoked. For example, __cf_bm is used for bot protection and expires after 30 minutes of inactivity; cf_clearance records a passed security challenge and its expiry depends on the configured challenge period. Their presence depends on the security features and requests involved; we do not claim every visitor receives them.

When you follow an authorization or game link, Roblox and Discord control cookies on their own domains under their own notices. We do not read their login cookies or ask you to copy them to us.

Your controls

You can inspect and delete cookies in your browser’s site-data settings and sign out from your Collapse account. Deleting an authentication cookie ends access in that browser; it does not by itself delete the account or a support record.

There is currently no optional cookie category to enable on this site. If optional storage or tracking is introduced, the policy and controls must be updated and any legally required consent obtained before activation, with an equally accessible way to decline and withdraw. A privacy notice alone is not consent.

For questions or data-rights requests, contact help@goldencrownent.com. Read the Privacy Policy for account information, providers, retention and rights.