Cookie Notice
The short version
MoonReward only sets two strictly necessary cookies: one keeps you signed in, the other protects the Steam sign-in. We use no analytics, advertising or tracking cookies, and nothing similar (no local storage, no fingerprinting). Because these cookies are strictly necessary to provide the service you asked for, the law does not require a consent banner for them, so we do not show one. If that ever changes, we will ask first.
1. The cookies
| Name | Purpose | Duration | Details |
|---|---|---|---|
sp_session | Keeps you signed in. It holds a random identifier; the server stores only a hash of it. | Up to 30 days (it ends sooner if unused for 7 days, or when you sign out) | First party, HttpOnly (not readable by scripts), SameSite=Lax, Secure on HTTPS. |
sp_login_state | Protects the Steam sign-in against forgery: it ties the answer from Steam to the browser that started the sign-in. | 10 minutes, deleted when the sign-in finishes | First party, HttpOnly, SameSite=Lax, only sent to the sign-in address. |
2. Third parties
- Steam. When you press “Sign in with Steam” you go to Steam’s website, which sets and reads its own cookies under Valve’s policy. We do not control them.
- Avatars are loaded from Steam’s servers, which receive your IP address when your browser requests them.
- Fonts and all other files come from our own servers. There are no embedded third-party scripts, widgets or trackers.
3. Your choices
You can delete or block cookies in your browser settings, but then you cannot stay signed in, and the Service will not work. To remove the session cookie, sign out (Account page) or delete your account.
4. More
See the Privacy Policy for how we handle personal data, and the contact page for questions.