Cookie Policy

A cookie is a small text file — usually a few hundred bytes — that a website asks your browser to store. The next time you visit, your browser sends that file back with the request. It is how any site remembers anything at all between pages: that you are logged in, that you chose English, that you have already dismissed a banner.

Cookies cannot run code, cannot read other files on your device, and cannot execute on their own. They are just labelled pieces of text. What makes them powerful is that a website can use one cookie to tie together activity across many pages — which is both useful (keeping you logged in) and potentially intrusive (tracking you from site to site). That tension is what modern cookie law exists to manage.

Cookie regulators and the industry have agreed on four categories. We use three of them; the fourth is reserved.

The table below is the whole list. If a cookie is in your browser from our domain and it is not on this page, that is a bug — tell us and we will investigate.

First-party cookies are set by our own domain. Third-party cookies are set by a partner we have integrated (Cloudflare for DDoS protection, the analytics tool we use). Third parties can only read their own cookies, never ours.

Cookies get most of the attention, but there are other ways to track a browser. We mention them so you know what we are not doing.

• No fingerprinting. We do not build a hidden identifier from your browser version, screen size, installed fonts and time zone. A small amount of device information is logged for fraud detection, but it is not used to persistently identify you.
• No tracking pixels from social platforms. No Meta Pixel, no TikTok pixel, no LinkedIn Insight tag. The consequence is that advertising we run elsewhere is less targeted, and we are fine with that.
• No localStorage persistence for tracking. We use localStorage for small UI states (is the sidebar open, did you dismiss a banner) but never to hold identifiers that survive cookie deletion.
• No sale of any data to advertisers or data brokers. This is in the Privacy Policy as a rule we cannot contract out of.

There are two routes. The first is our own preference panel. The second is your browser itself.

Two third parties can set cookies when you visit Robocat. They are both operational, not advertising.

• Cloudflare sits in front of our servers and blocks malicious traffic before it reaches us. The cf_clearance cookie confirms that your browser has passed a bot check. Cloudflare's own privacy policy explains what it does with the information it collects.
• Plausible / Matomo provides the aggregate analytics we mentioned above. The data does not leave the analytics provider and is never shared with advertisers. The analytics cookie only runs if you opt in.

When you load a game, the studio behind that game — Pragmatic Play, Evoplay and so on — handles its own session inside an iframe. Those studios may set their own cookies strictly to run the game. They receive a pseudonymous session ID from us; they never see your name, email, or payment details.

Cookies that store or access personal information are regulated alongside everything else we know about you. The rights in our Privacy Policy apply in full here too: access to the data behind a cookie identifier, correction, erasure, portability, restriction, and the right to complain to a supervisory authority.

For cookies specifically, the two rights that matter most day-to-day are the right to withdraw consent (flip any non-essential toggle to off) and the right to object (tell us, via [email protected], that you want a category disabled regardless of what the panel says). We act on both within one business day.

Most browsers can send a signal alongside each page request saying "do not track me". There are two versions. The old "Do Not Track" header has been around since 2009 but is not legally binding anywhere — we treat it as advisory. The newer Global Privacy Control signal, supported in Firefox and Brave, is legally recognised in California and increasingly elsewhere.

We honour Global Privacy Control. When your browser sends it, we treat the signal as a withdrawal of consent for analytics and any future marketing cookies, for the duration of your session and any stored preference on the same device. You can still flip individual toggles back on manually if you change your mind.

If the list of cookies changes materially — a new category, a new third-party provider, a change in retention — we update the dates at the top of this page and re-prompt through the cookie banner. Small housekeeping edits (fixing a typo, clarifying wording) are silent; nothing substantive happens silently.

For any cookie question, write to [email protected]. For a broader privacy concern or a regulator complaint, the relevant authorities are listed at the bottom of our Privacy Policy.