Cookie Policy

This page explains how GAMB·8 uses cookies and similar storage technologies, what each category does, and how you can control them. For the broader picture of how we handle personal data, see our Privacy Policy.

1. What Are Cookies?

A cookie is a small piece of data stored in your browser by the websites you visit. GAMB·8 also uses similar storage technologies — localStorage, sessionStorage, and IndexedDB — to keep your tool inputs, preferences, and bankroll history on your device. Where this policy says "cookies", we mean any of these client-side storage mechanisms.

2. Categories of Cookies We Use

Strictly Necessary Always on

Required for the site to function. These include the authentication session cookies that keep you logged in, CSRF tokens that protect form submissions, and the consent preference that remembers your cookie choices. You cannot opt out of these — without them, the site cannot keep you signed in or accept form input safely.

Cookie	Purpose	Retention
`gamb8_access`	JWT authentication token (httpOnly)	30 minutes
`gamb8_refresh`	JWT refresh token (httpOnly, restricted path)	24 hours
`gamb8_authed`	Auth indicator — lets the page detect login state	24 hours
`csrftoken`	Cross-site request forgery protection	Session
`sessionid`	Django admin session (staff only)	2 weeks
`gamb8_lang`	Language / locale preference	1 year

Consent preferences stored in localStorage: gamb8:analytics-consent, gamb8:marketing-consent

Functional / Preference Always on

These cookies remember your interface preferences so you don't have to re-set them on every visit. They do not track you across sites and contain no personal data.

Cookie	Purpose	Retention
`gamb8_casino_mode`	Casino persona mode (player / analyst / operator)	1 year

Analytics Opt-in (EU/UK)

We use PostHog to understand how features are used and to fix problems. Analytics cookies are only set after you consent on the cookie banner. In regions outside the EU/UK we treat acceptance as the default but you can disable analytics at any time from Settings → Privacy.

Provider: PostHog Inc. · Data: anonymised events, no PII · Retention: 90 days

Affiliate Attribution Set on referral

If you arrive via a partner link, we set a small attribution cookie (gamb8_ref or gamb8_referral) so the referring partner gets credit if you sign up. The cookie holds only an opaque code — no personal data — and expires after 60 days. It is cleared after you create an account.

Cookies: gamb8_ref, gamb8_referral · Retention: 60 days

Local Storage (Tool State) On device only

Tool inputs, calculator state, bankroll history, bet logs, and your interface preferences are kept in your browser's localStorage. This data never leaves your device unless you explicitly use a sync, export, or backup feature. You can clear it any time from your browser's site-data settings.

Storage: localStorage / sessionStorage / IndexedDB · Retention: until you clear it

Third-Party Cookies Service-dependent

Certain features rely on third-party services that may set their own cookies inside their iframes or scripts:

Stripe — set when the checkout iframe loads. Used for fraud prevention and payment processing. Governed by Stripe's privacy policy.
Firebase Cloud Messaging — used to deliver push notifications you have opted into on the mobile app. Governed by Google's privacy policy.
Sentry — error tracking; does not set browser cookies but collects anonymous error reports.
OAuth providers (Google, Discord, Kick, X) — when you choose to link an account, the provider's own cookies may be set during their consent flow. Governed by their respective privacy policies.

3. Managing Your Choices

You can manage cookie preferences in two places:

In GAMB·8 — visit Settings → Privacy to opt in or out of analytics. The same toggle is available from the cookie banner on first visit (EU/UK regions).
In your browser — every modern browser lets you view, block, or delete cookies through its site-settings menu. Note: blocking strictly necessary cookies will sign you out and prevent forms from submitting.

You can also clear all GAMB·8 device data — including bankroll history and tool state — from your browser's site-data settings.

4. Do Not Track & Global Privacy Control

GAMB·8 honours the Global Privacy Control (GPC) browser signal and the legacy Do Not Track (DNT) signal. When either is enabled, we treat the analytics opt-in as declined regardless of region, and PostHog is not initialised.

For California residents, a GPC signal is treated as a valid request to opt out of the "sale" or "sharing" of personal information under the California Consumer Privacy Act / California Privacy Rights Act (CCPA / CPRA), consistent with California Attorney General guidance. This opt-out persists for the browser session and is stored under the localStorage key gamb8:gpc-opt-out so your preference survives page navigation. You can also confirm or change the choice manually at Settings → Privacy or on our Do Not Sell or Share My Personal Information page.

5. Changes to This Policy

We may update this policy when we add new features or change service providers. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be flagged via the cookie banner so you can review and re-confirm.

6. Contact

For questions about cookies or to exercise your data rights:

GAMB·8 Privacy Team
privacy@gamb8.com