Your privacy

Cookie policy

We use cookies to run the site, and one more to remember which share link brought you here. We do not run advertising tags. You can change your choices at any time.

The categories we use

Necessary cookies are always on. Analytics loads only if you opt in. Two cookies under Marketing are also set without asking — loop_ref and founder_code — because we need to know which link or card brought you here before you've made any cookie choice. Each is spelled out below.

Necessary

Always on

Required to run the site and keep it secure — you can't switch these off. They don't track you for advertising.

session — keeps you signed in and preserves your basket/entry during checkout.
XSRF-TOKEN — protects forms against cross-site request forgery.
ww_consent — remembers your cookie choices so we don't ask again.
cf — set on your first visit, unless your browser sends a privacy signal. No consent is asked for it: today it is used only to help rate-limit requests, and is not saved in any of our databases. HttpOnly, 90 days.

Analytics

Opt-in

Helps us understand how the site is used so we can improve it. Loads only with your consent.

sq — set only if you accept analytics. A random reference, encrypted, 180 days. If you register, we copy it onto your account so your consented pre-account browsing can be joined to it. It is removed if you refuse analytics, and nothing else reads it.

We don't yet publish figures from this category ourselves — the reference above exists so a consenting visit can be joined to an account, not to run a dashboard today.

Marketing

Opt-in

Remembers which share link or invitation brought you here.

loop_ref — set when you follow a share or invite link, before you've made any cookie choice. No consent is asked for it — it is set the same way cf is, unless your browser sends a privacy signal. All it holds is which link you came from. If you go on to create an account, we use it to credit the person who invited you. It expires after 30 days.
founder_code — set when you follow a founder card invitation. Up to one year, and removed when you register.

We don't run advertising tags. No third party receives anything about your visit.

We also honour a Global Privacy Control (GPC) signal from your browser as an opt-out — and if your browser sends one, we don't set the arrival cookie either, even though it would otherwise be set before you'd chosen anything.

Legal detail

Retention periods, third-party and international data transfers, your data-subject rights, and the legal basis for each category will be set out here.

[Cookie policy legal wording — to be finalised by operator/solicitor]

Manage how we deliver messages to you in your account consents, and read about staying in control on our responsible play page.