Legal
Cookie & Storage Policy
Last updated 2026-10-02 · PlayParty.io
Overview
PlayParty.io ("we", "us", "our") uses cookies, local storage, and session storage to deliver a reliable watch-party experience, remember your preferences, secure your account, and gather anonymous performance metrics.
This policy explains what technologies we use, what data is stored on your device, and how you can control your storage preferences.
Local Storage (Essential & Functional)
Local storage allows our web application to store information locally in your browser so that your settings, room state, and credentials persist across page refreshes:
| Storage Key | Category | Purpose | Duration |
|---|---|---|---|
sb-*-auth-token | Category: Essential / Auth | Purpose: Stores Supabase JWT session and refresh tokens for authenticated accounts | Duration: Until sign-out / expiration |
playparty_username | Category: Functional | Purpose: Stores chosen display name for rooms, chat, and guest identity | Duration: Persistent (until deleted) |
playparty_user_id | Category: Essential | Purpose: Unique anonymous identifier for synchronizing guest room sessions | Duration: Persistent (until deleted) |
playparty_avatar_id | Category: Functional | Purpose: Default avatar preset identifier for your profile | Duration: Persistent (until deleted) |
playparty_profile_cache | Category: Functional | Purpose: Caches user profile data locally for fast initial page load | Duration: Persistent (until deleted) |
playparty_watch_history | Category: Functional | Purpose: Stores recently visited room IDs and media URLs (max 20 entries) | Duration: Persistent (until deleted) |
playparty_cookie_consent | Category: Essential | Purpose: Records whether you accepted or declined non-essential cookies | Duration: Persistent (until deleted) |
google_consent_settings | Category: Essential | Purpose: Stores granular Google Consent Mode v2 flags (analytics & ad consent) | Duration: Persistent (until deleted) |
ph_*_posthog | Category: Analytics & Telemetry | Purpose: Maintains anonymous session state, telemetry flags, and feature state for PostHog | Duration: 1 year (consent-based) |
playparty-player-volume | Category: Functional | Purpose: Saves your preferred video player volume level across rooms | Duration: Persistent (until deleted) |
playparty_sidebar_collapsed | Category: UI Preference | Purpose: Remembers whether the navigation sidebar is collapsed or expanded | Duration: Persistent (until deleted) |
playparty_room_media_[roomId] | Category: Functional | Purpose: Caches the current media URL and source for the specified room | Duration: Persistent (until deleted) |
playparty_room_pwd_[roomId] | Category: Security | Purpose: Stores room password hash to allow seamless re-entry into protected rooms | Duration: Persistent (until deleted) |
playparty_room_host_[roomId] | Category: Security | Purpose: Stores host authorization key to maintain host controls after reconnection | Duration: Persistent (until deleted) |
playparty_kick_cooldown_[roomId] | Category: Moderation | Purpose: Enforces cooldown timer after a kick to prevent immediate room re-entry | Duration: Temporary (until expiration) |
playparty_block_[roomId] | Category: Moderation | Purpose: Marks persistent room ban status on the local device | Duration: Persistent (until deleted) |
expired_link_cooldown_timestamp | Category: Security | Purpose: Throttles password reset and verification email requests against spam | Duration: Temporary (until cooldown ends) |
unverified_email | Category: Functional | Purpose: Caches email during the pending verification onboarding flow | Duration: Temporary |
reactivated_account_toast | Category: UI State | Purpose: Controls display of the account reactivation notification upon login | Duration: Temporary |
Session Storage & Extension Storage
- BroadcastChannel & In-Memory State: Used during active watch sessions for inter-tab communication, room presence synchronization, and WebRTC voice/video connection signaling.
chrome.storage.session(Companion Extension): Used solely by the optional PlayParty companion extension to temporarily hold detected media URLs. This storage is strictly ephemeral and is automatically cleared by the browser when the browser session ends.
Cookies & Third-Party Services
1. Cloudflare Security Cookies (Essential)
Cloudflare operates as our reverse proxy and CDN provider. Cloudflare may set strictly necessary security cookies (such as __cf_bm or cf_clearance) to manage bot detection, distinguish legitimate traffic from malicious automated requests, and mitigate DDoS attacks.
2. Google Analytics 4 (Analytics / Consent-Based)
When you accept analytics cookies via our banner, Google Analytics 4 collects aggregated, non-personally identifiable metrics on website usage:
_ga: Distinguishes unique visitors (Expires after 2 years)._ga_[CONTAINER_ID]: Maintains session state (Expires after 2 years)._gid: Distinguishes unique visitors (Expires after 24 hours).
We implement Google Consent Mode v2. If you decline cookies or adjust your preferences, Google Analytics is automatically blocked or runs in cookieless ping mode without writing identifiers to your device.
3. PostHog (Product Analytics, Session Replay & Error Diagnostics)
When you grant consent to performance and analytics storage, we use PostHog to analyze platform engagement, identify usability bottlenecks, diagnose client errors, and inspect session replays:
ph_[PROJECT_TOKEN]_posthog: Stores an anonymous visitor identifier, active session state, and diagnostic telemetry flags (Expires after 1 year).- Session Replays & Diagnostics: Records user interface interactions to diagnose front-end bugs and crashes. All sensitive form fields (e.g. passwords, authentication credentials) are automatically masked and redacted on your device before transmission.
PostHog operates strictly under your consent choices. If you decline analytics cookies in our consent banner or privacy settings, PostHog data capture and storage are immediately disabled (opted out).
4. Google Identity Services (One Tap Authentication)
If you interact with the Google One Tap sign-in prompt, Google Identity Services may set a g_statecookie on the client domain to prevent repeated intrusive prompts after dismissal.
5. Embedded Media Players
When you load media from third-party platforms (e.g. YouTube, Dailymotion, external HLS/DASH streams), those third-party domains may set their own independent cookies or local storage within their iframe player contexts. These cookies are governed by the respective third-party privacy policies.
Managing Your Cookie & Storage Preferences
You have complete control over how data is stored on your device:
- Cookie Banner: When you first visit PlayParty.io, you can accept or decline non-essential cookies, or open detailed settings to customize your consent categories.
- Privacy & Data Controls: From your account menu (accessible when signed in), navigate to Settings → Data & Privacy to download a full JSON export of all stored data, clear local browser caches, or permanently delete your cloud account.
- Browser Settings: You can configure your browser to block cookies, reject local storage, or clear all site data upon closing. Please note that disabling essential local storage may prevent room creation, authentication, and playback synchronization from functioning properly.
Contact Us
If you have questions regarding our use of cookies or storage technologies, please contact us at: privacy@playparty.io