Not legal advice. Cookie rules vary by country (e.g. UK/EU ePrivacy, national implementations). Customize this page and your consent flow with legal counsel.
Cookie policy
Last updated: March 30, 2026
What are cookies?
Cookies are small files stored on your device. Local storage is similar browser storage. Together they help websites remember preferences and keep you signed in.
What we use today
| Type | Name / key | Purpose | Duration |
|---|---|---|---|
| Cookie (HTTP) | Session | Keeps you logged in after you sign in via magic link. Essential for account features. | As configured by the site (e.g. weeks); cleared when you log out or it expires. |
| Cookie (HTTP) | CSRF token | Helps prevent cross-site request forgery on forms. Essential for security. | Short-lived (e.g. session / hours). |
| Local storage | mud-theme |
Remembers light/dark theme in the browser. Optional for comfort; not required to play. | Until you clear site data. |
| Local storage | Play preferences (e.g. colors, UI options) | Stored by the play client for display preferences. Optional. | Until you clear site data. |
| Local storage | mud_cookie_consent_v1 |
Records that you acknowledged our cookie notice so we do not show it every visit. | Until you clear site data. |
Login CAPTCHA (Cloudflare Turnstile)
When we enable bot protection on the sign-in page, your browser loads a widget and script from Cloudflare (challenges.cloudflare.com and related Cloudflare domains). That is a third-party service we do not host.
- What loads: Cloudflare’s Turnstile JavaScript runs only on pages where we embed it (typically /login).
- Cookies and storage: Turnstile may set or use cookies, local storage, or similar technologies on Cloudflare’s side to operate the challenge, remember risk signals, or adapt difficulty. Those are not first-party cookies on our domain—we do not control Cloudflare’s files. Cloudflare’s own policies describe what they use.
- Why: To reduce automated abuse (mass sign-in attempts, credential stuffing) before we send a magic link.
- If Turnstile is off: When we do not configure Turnstile, that script does not load and this section does not apply for you.
See our Privacy policy for what our servers send to Cloudflare when verifying a completed challenge. Independent overview: Cloudflare privacy policy (URL may change).
Stripe Checkout & hosted payment pages
If we add paid features, checkout is expected to use Stripe Checkout (or other Stripe-hosted pages), similar to our other sites: when you click to subscribe or buy, your browser may leave our domain and load stripe.com (or Stripe’s payment UI). While you are on Stripe’s pages, Stripe may set cookies or use similar technologies on their side—we do not control those. After payment, Stripe redirects you back to our site with a result (success, cancel, etc.).
We will update this policy when those flows go live and, where the law requires it, adjust our cookie banner or consent options for any new non-essential technologies on our domain. If any first-party cookie is set on our domain as part of return-from-Stripe flows, we will add it to the table in What we use today.
Analytics (if added)
If we add analytics or other third-party tools that set cookies on our domain, we will list them here and obtain consent where required.
Your choices
You can block or delete cookies and site data through your browser settings. If you block essential cookies, login and forms may not work.
More information
See our Privacy policy for how we use personal data.