Legal

Cookie Policy

Last updated: May 23, 2026

This Cookie Policy explains how RollReport uses cookies and similar technologies on https://rollreport.gg (the "Service"). Our full Privacy Policy is at /legal/privacy.

Summary

RollReport uses exactly one cookie: a strictly-necessary session cookie required for authentication. We do not use third-party analytics, advertising, or tracking cookies. No consent banner is required under the ePrivacy Directive or similar laws because our only cookie falls under the "strictly necessary" exemption.

The Single Cookie We Set

Attribute Value
Namerollreport.session_token (or Better Auth default cookie name)
PurposeAuthentication session — identifies a signed-in user after they log in.
Domain.rollreport.gg
Path/
HttpOnlyYes
SecureYes (HTTPS only)
SameSiteLax
Expires30 days (rolling)

Technical details:

  • The cookie value is an opaque, signed session token (HMAC-SHA256 signature using a server-side secret).
  • HttpOnly prevents JavaScript on the page from reading the cookie value, mitigating XSS-based theft.
  • Secure ensures the cookie is only transmitted over HTTPS.
  • SameSite=Lax blocks the cookie from being sent on cross-site POSTs, mitigating CSRF.
  • expires is rolling — each request within the 30-day window extends the session; stale sessions are cleaned up nightly.

What We Do NOT Use

  • No Google Analytics or similar third-party analytics cookies.
  • No Facebook Pixel, Twitter pixel, LinkedIn Insight, or other ad tracking.
  • No A/B testing platforms that set identifying cookies.
  • No fingerprinting libraries or device IDs.
  • No cross-domain tracking — we don't operate a tag manager network.

Local Storage and Service Worker

RollReport is a Progressive Web App. We use:

  • Service worker (/sw.js) — caches static assets (CSS, fonts, images) for offline support. Does not store personal data.
  • localStorage — may cache non-sensitive UI preferences (e.g., last-used state filter). Does not store authentication tokens or personal identifiers.
  • Cache Storage API — stores offline fallback versions of already-visited pages.

These technologies are not cookies and do not transmit data to servers cross-domain.

Third-Party Embeds

Athlete profile pages may embed videos from third-party platforms:

  • YouTube — may set its own cookies on the user's device when the embed loads and plays. We use youtube-nocookie.com domain where possible.
  • Instagram — embedded posts load from Instagram's servers and may set Meta cookies.
  • FloGrappling — links-only (deep links to FloGrappling's site); no embed.

These third-party cookies are set by the respective platforms, not by RollReport, and are subject to their own privacy policies. Where we can choose a privacy-preserving embed (such as youtube-nocookie), we do.

Managing Cookies

You can control cookies through your browser settings:

  • Chrome: Settings → Privacy and security → Cookies and other site data.
  • Safari: Settings → Privacy.
  • Firefox: Settings → Privacy & Security.

Blocking the session cookie will prevent you from signing in. All other functionality is unaffected.

Changes to this Policy

We will update this policy if we introduce any additional cookies or tracking technologies, with notice via the site and the "Last updated" date above.

Contact

Questions about cookies: hello@rollreport.gg.