Cookie Policy

1. What this page is

A cookie is a small file a website asks your browser to keep, so that the site can recognise the browser on the next request. This page lists every cookie edits.gg sets, what each one is for, and how long it lasts. We do not use any cookie for advertising or for tracking you across other websites.

Every cookie here is set by us, on edits.gg. None of them is set by a third party, and none is shared with one.

2. Staying signed in

When you sign in, our authentication provider sets session cookies whose names begin with sb-. They hold your session and are what keeps you signed in between pages. They are essential: without them the site cannot tell one signed-in person from another, and you would be signed out on every click. They last for as long as you stay signed in: they are refreshed while you use the site and are cleared when you sign out.

edg_setup, kept for 7 days. Once you have finished signing up, this records that you have, so that pages can load without checking the database again on every request. It holds nothing but that note and the account it was written for, it is not readable by JavaScript, and it does nothing in a browser signed in as somebody else. It expires on its own, and deleting it changes nothing you would notice.

edg_seen, kept for 2 days. While you are signed in, this records that today has already been counted in the record of days you used edits.gg, which our Privacy Policy describes, so it is written once a day rather than on every page. It holds the date and a signature tied to your account, it is not readable by JavaScript, and it expires on its own.

3. Remembering which browsers you have verified

edg_device, kept for 30 days. Once you have entered a sign-in code, this records that this browser has passed one. It does not let anybody skip the code: every sign-in asks for one.

It holds a random value and nothing else. It is not readable by JavaScript, it is not an identifier we use anywhere else, it is replaced with a new value every time a code is used, and signing out clears it. Deleting it changes nothing you would notice.

4. Cookies that only exist mid-flow

edg_challenge, kept for 15 minutes. It links the sign-in code we emailed you to the step where you type it in, so that a code cannot be used from somewhere else. It is deleted the moment the code is used.

edg_payout_challenge, kept for 15 minutes. The same thing for the code we send when you change where your money is paid out to. Changing a payout destination is the one action worth an extra check, so it has its own code and its own cookie.

edg_email_stepup, kept for 15 minutes. The same thing again for the code we send to your CURRENT address before your email can be changed. Moving the address is what gets you back into the account, so it takes its own check.

edg_admin_login, kept for 15 minutes. Only ever set on the staff console, holding which sign-in code that browser is answering.

eg_admin_grant_challenge, kept for 15 minutes. Only ever set for staff, holding the code that confirms a change to who has admin access.

tiktok_oauth_state, kept for 10 minutes. Set when you press Sign in with TikTok. It is a random value we check on the way back, so that somebody else cannot start that flow on your behalf. It is deleted the moment you return.

google_oauth_state, kept for 10 minutes. The same thing again for connecting a YouTube channel with Google. It is a random value we check on the way back, and it is deleted the moment you return.

discord_link_confirm, kept for 10 minutes. Set when you come back from Discord while linking your Discord account. It holds a random value and the Discord account you signed in with, so that the confirm button you then press is answering the same link you started. It only exists on that one page and is deleted the moment you confirm or cancel.

connect_from, kept for 10 minutes. Set when you start linking a social account from a page other than Accounts, such as during sign-up. It holds which page you started from, so linking can send you back there instead of always landing on Accounts. It is deleted once the hand-off finishes.

connect_campaign, kept for 10 minutes. Set alongside it when you start linking from a campaign page, or from a rate request that began on one. It holds that campaign's link name, so you land back on the same campaign afterwards.

5. Where a referral link sent you

edg_ref, kept for up to 90 days. Set when you open an editor's referral link, so that if you go on to create an account, that editor can be credited. It holds a profile id, not a name, cannot be read by JavaScript, and is never sent anywhere but our own servers. It is deleted the moment it is used, whether or not the credit succeeds, and it is spent at most once.

6. Things kept in your browser, not sent to us

Two things are stored by your browser and never sent to our servers. The homepage keeps a note that its opening animation has already played, so it does not replay on every visit in the same tab session. Your dashboard keeps a copy of your notification preferences so the page can render them before it has heard back from us.

A campaign you are building is also saved in your browser as you type, so a refresh does not lose it. It is cleared once the campaign is saved.

7. Consent

We do not show a cookie banner. Every cookie above is either strictly necessary for the site to work, such as signing in, staying signed in, and confirming it is you, or part of a service you asked for by using it, such as crediting whoever's referral link brought you here or sending you back to the page a linking flow started from. None of it is used for advertising, analytics or profiling, so there is nothing to ask you to opt into and nothing you could turn off while still being able to sign in. Vercel Web Analytics, described in section 8, sets no cookie at all.

8. What we do not use

We do not use analytics cookies, advertising cookies, retargeting pixels, social media tracking pixels, or any third-party tracker. There is no Google Analytics, no Meta pixel, and no tag manager on this site. We do not sell or share your information with anyone for advertising.

We do count page views, using Vercel Web Analytics. It does not set a cookie and does not store anything on your device, which is why it does not appear in the table above. It records the page you visited, the country you visited from, and the kind of device. It does not identify you. Vercel Speed Insights, which measures how quickly pages load, works the same way: no cookie, nothing stored on your device, and only load timings with the page, country and kind of device.

9. Managing cookies

Every browser lets you see and delete cookies, and block them. Blocking or deleting ours will sign you out and will mean you are asked for an emailed code the next time you sign in. Connecting a TikTok account, a YouTube channel or a Discord account also needs one for the length of that flow, because the check that stops somebody starting it on your behalf is a value we leave in your browser and read on the way back.

10. Contact

Email support@edits.gg or find us in our Discord.