Cookie policy
Every cookie this app sets, named individually, and why you are never asked to accept one.
triumph.saltares.dev · Last updated 29 September 2026
This cookie policy (“Policy”) describes the cookies used by the Triumph! Army Builder website at triumph.saltares.dev (“Website”, “Service” or “Services”), operated by Saltares Marquez David Persoana Fizica Autorizata (“we”, “us” or “our”). It names every cookie individually, because there are few enough of them to list. For how we handle personal information generally, see our privacy policy.
The short version. The Website sets only cookies that are strictly necessary for it to work: keeping you signed in, holding your saved lists against your browser if you have not signed up, and securing sign-in with Google or Discord. There are no analytics cookies, no advertising cookies and no third-party tracking cookies. That is why you are not asked to accept anything — there is nothing optional to consent to.
What cookies are
Cookies are small text files a website asks your browser to store and send back on later requests. A session cookie lasts until you close your browser; a persistent cookie survives until it expires or you delete it. A first-party cookie is set by the site you are visiting; a third-party cookie is set by someone else whose content the page loads, and is the mechanism behind most tracking across websites. The Website sets no third-party cookies, because it loads no third-party content.
The cookies we use
All of these are strictly necessary. Each is a first-party cookie set on triumph.saltares.dev, sent only to our own server, and all except the Cloudflare entries are marked HttpOnly (so JavaScript on the page cannot read them), Secure (so they travel only over HTTPS) and SameSite=Lax.
- Cookie
__Secure-better-auth.session_token- Lifetime
- Persistent
- What it is for
- Identifies your session, so the server knows which account or which browser is making the request. This is the cookie that keeps you signed in — and, if you have saved lists without creating an account, it is the only thing connecting you to them. Deleting it signs you out; deleting it without an account loses those lists permanently. Set when you sign in, or the first time you save a list while signed out. Anonymous sessions are deliberately long-lived so that a list saved today is still there next month.
- Cookie
__Secure-better-auth.dont_remember- Lifetime
- Session
- What it is for
- Set when you sign in without asking to be remembered, so that your session ends with your browsing session rather than persisting.
- Cookie
triumph.claimed_lists- Lifetime
- 5 minutes
- What it is for
- Set only at the moment you sign in with lists saved against this browser, so that the page that loads next can tell you how many were added to your account and offer to undo it. It holds the identifiers of those lists and nothing else, it is readable by the page rather than by the server alone, and it is deleted as soon as the message has been shown.
- Cookie
__Secure-better-auth.state- Lifetime
- 5 minutes
- What it is for
- Set only while you are signing in with Google or Discord. It holds a single random value that is matched against a record on our server when the provider sends you back, which is what proves the response belongs to the sign-in you started and stops one being forged. The rest of the exchange, including the verifier, is held on the server and never placed in your browser.
- Cookie
__cf_bm,cf_clearanceand other Cloudflare cookies- Lifetime
- Up to 30 minutes, or up to a year for cf_clearance
- What it is for
- Set by Cloudflare, which sits in front of our server on every request, to distinguish human visitors from automated traffic and to remember that a challenge has been passed. They are security cookies; Cloudflare does not use them to profile you or to serve advertising.
The first three carry a __Secure- prefix over HTTPS, which is how you will see them in production. Running the app locally over plain HTTP, the prefix is absent.
Not a cookie, but stored in your browser
Your light or dark theme preference is kept in your browser’s local storage under the key theme. It never leaves your device, is never sent to our server, and exists only so the page does not flash the wrong colour scheme when it loads. Clearing site data resets it to following your system setting.
What we do not use
- No analytics cookies. There is no analytics product on the Website. The activity log our privacy policy describes is kept on our own server and adds no cookie: it recognises you by the session cookie above, if you already have one, and otherwise not at all.
- No advertising or retargeting cookies, and no advertising identifiers.
- No third-party or cross-site tracking cookies. The Website loads no third-party scripts, no embedded social widgets and no externally hosted fonts, so no other party is in a position to set a cookie on your visit.
- No preference cookies beyond the local-storage theme setting described above.
Why there is no cookie banner
Under the ePrivacy Directive and the GDPR, consent is required for cookies that are not strictly necessary to deliver a service the user has asked for. Every cookie listed above is strictly necessary in that sense — authentication, keeping your saved lists attached to you, and security — so no consent banner is required and we do not show one. If we ever add a cookie that falls outside that exemption, we will ask you first and this Policy will change to say so.
Your options
You can delete cookies already set and refuse new ones through your browser’s settings, and every major browser lets you do this per site. Be aware of the consequences on this Website specifically:
- You will not be able to sign in, or to stay signed in.
- If you have saved lists without an account, blocking or clearing cookies permanently loses them. Nothing else ties those lists to you, and we cannot recover them.
- Everything else — browsing army lists, categories and the reference material, and building a list without saving it — works with cookies disabled.
If you want your lists to survive clearing your browser, or to follow you from your phone to your laptop, create an account. That is the difference an account makes.
Changes to this Policy
We may update this Policy. When we do, we will revise the date at the top of this page, and the updated version takes effect when it is posted. Continuing to use the Website after that means you accept the revised Policy.
Contact
Questions or complaints about this Policy or about our use of cookies: [email protected]
Saltares Marquez David Persoana Fizica Autorizata, operator of triumph.saltares.dev.