Cookie Policy
This document is available in English only. The English version is the authoritative text.
1. Why there is no cookie banner
We only set cookies that are strictly necessary to run the site. There is no Google Analytics, no advertising network, no tracking pixel and no third-party profiling here. The only usage statistics we keep come from Umami, which runs on our own server and sets no cookies at all. Under EU and UK rules, consent is not required for strictly necessary cookies — so we do not interrupt you with a banner asking for something we do not need.
If that ever changes — if we add a cookie that is not strictly necessary — we will ask for your consent properly before setting it, and update this page first.
2. What cookies are
A cookie is a small text file a website asks your browser to store and send back on later visits. It is how a site remembers that you are signed in, rather than asking for your password on every page.
Cookies are not inherently invasive. What matters is what they are used for. Ours are used to keep your session alive, to protect the site from attack, and to remember two display preferences. None of them tell us anything about what you do elsewhere on the internet.
3. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
at | Access token. Authenticates each request you make while signed in. Hidden from JavaScript and never sent with forms or background requests from other sites. | Strictly necessary | 15 minutes |
rt | Refresh token. Lets your session renew itself so you are not signed out constantly. Also hidden from JavaScript. | Strictly necessary | Until the session expires |
csrf | Cross-site request forgery token. Deliberately readable by JavaScript — that is how the double-submit protection works — and useless to anyone else. | Strictly necessary | Until the session expires |
user_timezone | Your time zone, so kick-off times show in your local time rather than ours. | Functional | Persistent |
color-mode | Whether you chose the light or dark theme. | Functional | Persistent |
The three authentication cookies are marked Secure and SameSite=Lax. They are only sent over HTTPS, and another site can never make your browser send them with a form, a background request or an embedded page. They are sent when you follow a link to ScorePredicts from another site, so you arrive signed in. They are cleared when you sign out.
4. Local storage
We also use your browser's local storage — a similar mechanism to cookies, with one important difference: it is never transmitted to our servers. It stays on your device.
We use it to remember:
- teams and competitions you have favourited;
- leagues you have pinned to the top of a list.
Clearing your browser data removes these. Nothing else is lost — your account is unaffected.
Our usage statistics (described in the Privacy Policy) store nothing in your browser. The statistics script only checks for an opt-out flag named umami.disabled, which exists only if you set it yourself; it never creates or changes anything.
5. Third-party cookies
Our pages set no third-party cookies. Images and profile pictures are served from Bunny CDN, which delivers files without setting cookies on your browser.
Paddle — our payment provider and merchant of record — is loaded only when you choose to subscribe or open a payment link from a Paddle email. Its checkout, and the payment processors Paddle uses to handle your card, then set cookies that are necessary to process your payment securely and prevent fraud. Those are handled by Paddle under Paddle's own privacy policy, and they are strictly necessary to complete a transaction you have chosen to start. Nothing from Paddle is loaded, and no Paddle cookie is set, before that.
6. Managing cookies
You can view, block or delete cookies in your browser settings. Every major browser offers this under privacy or site settings, and all of them let you clear cookies for a single site.
Be aware of the trade-off. If you block the three authentication cookies:
- you will not be able to sign in, or you will be signed out immediately;
- forms that change something will fail, because the CSRF protection cannot work;
- the free and paid features tied to an account will be unavailable.
Blocking only user_timezone and color-mode is harmless — times will display in a default zone and the theme will reset on each visit.
Browsing the site signed out, and reading fixtures, results, standings and the free content, works with cookies blocked entirely.
7. Changes to this policy
If we add, remove or change a cookie, we will update this page and the date at the top of it. If we ever introduce a cookie that is not strictly necessary, we will ask for your consent before setting it.
8. Contact
Questions about cookies or anything else on this page go to support@scorepredicts.com.
See also our Privacy Policy, which covers everything else we do with personal data.