Legal · Cookie Policy

Cookie Policy

A short, honest list of every cookie and storage entry leak.fun sets. We’re strictly first-party — no ads, no analytics, no tracking. What you see here is the entire footprint.

Last updated May 19, 2026

01

What Are Cookies?

A cookie is a small text file that a website stores in your browser. When you return to the site, the browser sends the cookie back so the site can remember who you are, what your preferences look like, and whether you're still signed in. Cookies are the plumbing that makes a session-based web app actually work.

This policy also covers similar local-storage technologies (localStorage and sessionStorage) for full transparency, even though they aren't cookies in the strictly technical sense. We use both, both are described below, both can be cleared at any time from your browser.

02

Why We Use Them

We use cookies and local storage for exactly two purposes:

  • Authentication — to keep you signed in after you log in, without making you re-enter your password on every page load.
  • Preferences — to remember your theme (light / dark / system) and your locale (EN / FR) across visits.

We do not use cookies for advertising, behavioral profiling, cross-site tracking, or analytics. We do not embed third-party scripts that set cookies on our behalf. The dashboard is a tool, not a billboard.

03

Cookies We Set

The following cookies are set by leak.fun directly (first-party). All are strictly necessary for the Service to function:

next-auth.session-token

30 days from last activity

HttpOnly, Secure, SameSite=Lax

Keeps you signed in. Contains a signed JWT — the value is not human-readable and is verified server-side on every protected request.

next-auth.csrf-token

Session (cleared when browser closes)

HttpOnly, Secure, SameSite=Lax

Prevents cross-site request forgery on authentication endpoints. Pairs with the form-submission flow to guarantee the sign-in request actually came from our own pages.

next-auth.callback-url

Session

HttpOnly, Secure, SameSite=Lax

Stores the URL you were trying to visit before being redirected to /login, so we can send you back there after sign-in.

All three are managed by NextAuth. We don't set any other HTTP cookies.

04

Local Storage We Use

A few values are stored in your browser's localStorage. These never leave your browser — they aren't sent to our servers with any request.

theme

Until you clear it

localStorage, first-party

Your colour scheme preference (light, dark, or system). Read on page load so the right theme applies before React hydrates — avoids a flash of the wrong theme.

leakfun:locale-preference:v2

Until you clear it

localStorage, first-party

Your explicit language choice (en or fr). When absent, the site automatically uses French for French-speaking browser locales and English otherwise.

leakfun:sidebar-collapsed

Until you clear it

localStorage, first-party

Whether you want the dashboard sidebar collapsed or expanded. Survives reloads so your layout choice sticks.

leakfun:webgl-notice-dismissed

Until you clear it

localStorage, first-party

Remembers that you dismissed the WebGL compatibility notice, so it is not shown on every visit.

05

Third-Party Cookies

We do not set any third-party cookies. We don't embed Google Analytics, Meta pixels, advertising tags, or social media share widgets that load tracking scripts. The marketing pages and the dashboard are equally light on third-party requests.

If we ever introduce a third-party dependency that sets cookies (for example, an embedded customer-support widget), we will update this policy and list the specific cookies it sets before turning the integration on.

06

Managing Cookies

You can clear or block cookies at any time through your browser settings. Note that blocking the next-auth.session-token cookie will sign you out and prevent you from accessing the authenticated parts of the Service.

Per-browser quick links:

  • Chrome — Settings > Privacy & Security > Cookies and other site data
  • Firefox — Settings > Privacy & Security > Cookies and Site Data
  • Safari — Preferences > Privacy > Manage Website Data
  • Edge — Settings > Cookies and site permissions > Manage and delete cookies

To clear our localStorage entries specifically, open your browser's developer tools, navigate to Application > Local Storage (in Chrome / Edge) or Storage > Local Storage (in Firefox), find leak.fun, and delete the entries you want.

07

Changes to This Policy

We'll update this policy whenever we add or remove cookies. Material changes are announced at least 14 days in advance via email and through a notice on the Service. The table of cookies above is the source of truth — if you ever spot a cookie set by leak.fun that isn't listed here, let us know and we'll either add it to the policy or remove it.

08

Contact Us

Questions about our use of cookies, or about anything cookie-adjacent in your browser's storage:

We aim to respond within 5 business days. For broader privacy concerns, the Privacy Policy is the full picture — this page is the close-up on the storage layer.