Cookie Policy

Last updated: 2026-11-11 (version 2026-11-11)

This English translation is provided for convenience. The Portuguese version prevails.

This Cookie Policy explains what cookies are, how GameTale uses them, the categories of cookies we set, and the choices you have. For broader information on how we process personal data, see our Privacy Policy.

1. What Are Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, or work more efficiently, and to provide reporting information to site owners. The term “cookies” in this policy also covers similar client-side storage technologies such as localStorage and sessionStorage when used for the same purposes.

2. Categories We Use

We use three kinds: essential cookies, which the Service cannot work without; analytics cookies, which are set only if you opt in; and preferences kept in your browser’s own storage, which never leave it.

2.1 Essential

These are necessary for the Service to function: sign-in, authentication session, security (CSRF mitigation), language, consent state, and returning you to the page you came from after you sign in or activate your account. They cannot be turned off without breaking core functionality, so we set them under the LGPD/GDPR “legitimate interest” basis without explicit prior consent. Examples:

• session_id: your signed-in session token (httpOnly, SameSite=Lax, Secure in production).
• gt_consent: records your cookie-banner choice so we do not re-prompt you on every page (1 year).
• NEXT_LOCALE: remembers the language you use GameTale in, so each page opens in it.
• oauth_state and oauth_code_verifier: set only while you sign in with Google, Facebook or Instagram, to protect that sign-in against forgery (httpOnly, 10 minutes, cleared when the sign-in finishes).
• gt_continuation: remembers where to send you back when the path leaves GameTale, such as a sign-in with Google, Facebook or Instagram or the account activation link sent by email. It holds only the address of a page on GameTale itself (httpOnly, 30 minutes, cleared once it is used).
• checkout_receipt_sid: holds for 2 minutes after a payment the payment processor’s checkout session identifier, so the billing page can show your receipt without that identifier appearing in the page address (httpOnly).

2.2 Analytics

These help us understand how readers and authors use the Service so we can improve it. They are loaded only after you opt in via the cookie banner, and never while your browser sends a Do Not Track or Global Privacy Control signal (section 5), nor for the account of someone under 18, whatever the choice in the banner. We do not use these cookies for ad targeting and we do not sell aggregated analytics data.

• Vercel Analytics (__vercel*, vd): privacy-friendly page-view measurement.
• Vercel Speed Insights: anonymous Web Vitals performance telemetry.
• Google Analytics 4 (_ga, _ga_*): audience measurement. GameTale tells it which screen you opened, as the route rather than the address you visited (a chapter you are reading is reported as /[locale]/read/[storySlugAndId]/[chapterSlugAndId] with the story’s and the chapter’s database identifiers beside it), and that same route is what we send in place of the page title. We send the route rather than the title because on GameTale the title of a page is a story title, an author’s username, or the name of a draft nobody has published. Google Analytics’ own automatic page measurement, which would have read your browser tab and your address bar instead, is switched off in the first line of its configuration. What reaches it is produced by the same code that produces the PostHog page view described below, so the two cannot differ, and it receives none of the other steps listed there. It never receives your email address, your username, a story title, or anything else you typed. IP addresses are truncated by Google before storage.
• gt_attr (GameTale, first-party, 90 days): remembers how you first reached GameTale and how you most recently did, as the campaign labels in the link you followed (for example utm_source), the name of the site or app that sent you from a short fixed list (Instagram, TikTok, WhatsApp, Google and similar, otherwise “other”) and the type of page you landed on, never the address of the page or of the site that referred you. If you then create an account, we keep that same summary with it to learn which links bring in new authors and readers. Like the others in this list it is set only after you opt in, and withdrawing your choice in the banner deletes it.
• PostHog (ph_* cookies, plus matching localStorage entries holding the same anonymous identifier): product analytics. It records which screen you opened, as the route rather than the address you visited (a chapter you are reading is reported as /[locale]/read/[storySlugAndId]/[chapterSlugAndId] with the story’s and the chapter’s database identifiers beside it), and the steps you took: signing in and signing up, opening the account activation link, choosing your genres, creating stories and chapters, opening the editor and publishing, opening a story or a chapter and finishing it, which branch you chose at a decision point, creating or branching a save slot, viewing the pricing page and starting a checkout, and that you granted consent here. Section 5 of the Privacy Policy sets that list out in full, item by item. It never receives your email address, your username, a story title, or anything else you typed. Autocapture is switched off, so PostHog never reads the text on a page to work out what you clicked, and a profile is created for you only if you are signed in, keyed by your account’s internal identifier. When you sign in, the events this browser sent earlier while you were not signed in are linked to that profile; this happens only with your analytics consent, and signing out ends the link. Session recording (a replay of what happened on your screen) runs on a closed list of screens and nowhere else: the home page, signing up, signing in, the "forgot password" form and the page confirming its email was sent, the page confirming a password was changed, the onboarding steps, the pricing page and the checkout. It does not run on the two screens opened by a link in an email, account activation and the page where you choose a new password, because those web addresses carry a single-use token and a recording captures the address along with the screen. It never runs on the reader, the chapter editor, the story creation wizard, a profile, your account settings, or the catalogue and its search, so no draft and nobody’s profile is ever filmed. The home page shows only stories already published, which any visitor can see. What you type into a field is masked before the recording leaves your browser, and recordings are deleted after 30 days. PostHog discards your IP address on arrival, without storing it. It is covered by the same analytics consent as everything else described here, and the list of screens lives in our source code rather than in a setting that could be changed without one. It is not loaded at all until you opt in, withdrawing consent stops it capturing immediately, and clearing your browser’s site data removes its cookies and its storage entries. PostHog is hosted in the United States; see section 6.1 of the Privacy Policy.

2.3 Browser Storage (Never Sent to Our Servers)

The preferences listed in this section live only in your browser’s localStorage or sessionStorage and are never transmitted to GameTale or any third party. The analytics identifiers described in 2.2 are a separate matter: they exist only if you opted in, and they are sent to the processor that set them.

• gametale.auth.last-method: remembers which sign-in method (Google, Facebook, Instagram, or email) you used last, so we can highlight it the next time you sign in. It never reaches our servers, is not used to decide what you may do, and is removed when you clear your browser’s site data.
• Reading preferences (gametale.reader.preferences, gametale.reader.chrome-pinned, vn-audio-settings): text size, whether the reader’s controls stay visible, and your sound volume.
• Editor preferences (editor_tour_completed, gametale_editor_sidebar_width_*): whether you finished the editor tour, and how wide you like its panels.
• theme: the light or dark theme you chose.
• gametale:password-reset-request, in sessionStorage: the email address you just asked a password reset for and when, so the confirmation screen can show it and time the resend button. It stays in that browser tab and disappears when you close it. Waiting times after too many attempts are kept in the same way, in localStorage, so a reload does not reset them.
• gt_pwa_install: remembers how many times you have visited and when you last dismissed the invitation to install GameTale as an app, so it is not shown on a first visit and stays away for 30 days after you say “Not now”. It holds two numbers and nothing about who you are, never reaches our servers, and is removed when you clear your browser’s site data.
• gt_pwa_visit_counted: kept in sessionStorage rather than localStorage, so one browsing session counts as one visit for the entry above. Your browser deletes it when you close the tab.

3. Third-Party Cookies

Cookies set by Vercel Inc., Google LLC, and PostHog Inc. are governed by their own privacy policies. We do not control their cookies once set. Their retention periods, IP-handling rules, and opt-out mechanisms are defined by them.

Cloudflare Turnstile, the bot verification, loads a script and a frame (iframe) from Cloudflare’s servers on the sign-up, sign-in and "forgot password" pages and in the feedback form. To confirm that whoever sends the form is a person, it receives your IP address and reads browser and device signals while the form is open; GameTale gets back only the result and does not store those signals. It is a security measure, so it does not depend on the cookie banner and is not switched off by Do Not Track or Global Privacy Control. Whatever Cloudflare keeps in your browser for that check is governed by its own privacy policy (section 5 of the Privacy Policy).

4. Your Choices

You can change your cookie preferences at any time from the “Cookie Preferences” link in the site footer. Withdrawing consent stops analytics capture immediately: GameTale sends nothing further to any analytics processor, and Google Analytics is told to deny analytics storage. Cookies already set by an analytics processor stay in your browser until you clear your site data, as described in section 2.2. Essential cookies remain in place because sign-in and session security depend on them.

5. Browser Settings

Most browsers let you block or delete cookies through their settings. Blocking essential cookies will prevent you from signing in or staying logged in. If your browser sends a Do Not Track signal, GameTale loads no analytics at all: Google Analytics 4, PostHog, Vercel Analytics and Vercel Speed Insights are never started, so none of them sets a cookie or receives a request. That applies even if you have accepted analytics cookies here, because the signal is a standing answer you gave your browser and we do not treat a click in our banner as permission to overrule it. Turning the signal off and reloading the page restores the choice you saved. Essential cookies are unaffected, because sign-in and session security depend on them.

Global Privacy Control (GPC) is honoured in exactly the same way. If your browser or a privacy extension sends the GPC signal, none of those four analytics tools is started, none of them sets a cookie or receives a request, and that holds even if you accepted analytics cookies here. Turning the signal off and reloading the page restores the choice you saved, and essential cookies are unaffected.

6. Changes to This Policy

We may update this Cookie Policy when we add new processors or change cookie behavior. The version date at the top reflects the most recent update. Material changes will be announced inside the Service.

7. Contact

For questions about this Cookie Policy contact support@gametale.app.