Cookies

Short version

• We set first-party cookies only. No Google Analytics, ads, or other tracker pixels in this app.
• Anonymous visits use a cookie named aij_vid.
• Signing in with Discord adds Auth.js session cookies.
• Your OpenRouter key is stored in this browser, not in a cookie.
• Send DNT or GPC and we skip the visit beacon.

Visitor cookie

aij_vid is a random 32-character token. It is not your Discord id. It is httpOnly, SameSite=Lax, path=/, and lasts about 400 days. In production it is marked Secure.

We hash the token (SHA-256) and count one unique per UTC day plus a page-path tally. We do not store IP, user agent, or referrer. Path query strings are dropped; ids in the path become :id. Those rollups are deleted after about 200 days. Staff see totals on /admin.

The cookie is set when the visit beacon runs. If your browser sends Do Not Track or Sec-GPC, this site does not send that beacon.

Sign-in cookies

Discord login uses Auth.js (NextAuth). Typical cookie names are authjs.session-token, a CSRF cookie, and short-lived callback / PKCE cookies during the Discord redirect. On HTTPS they may be prefixed __Secure- or __Host-. We do not rename them in this codebase.

Those cookies are needed to stay signed in. They are not used for advertising. Clear them by signing out or clearing site data.

Browser storage (not cookies)

• ai-judge:openrouter-key in localStorage — your full OpenRouter key. Sent to this server as x-openrouter-key for model calls. Never written to the database.
• ai-judge:show-judge-streams in localStorage — a UI preference.
• ai-judge:run-draft in sessionStorage — the configure-run wizard draft for this tab.
• ai-judge:pack-rules-ack in sessionStorage — remembers you read pack rules in this tab.

Clearing site data for this origin removes the key and the preferences. That does not delete public runs or chats already on the server.

Other people’s cookies

Discord’s login and avatar CDN are Discord’s services. OpenRouter is called from this server with your key — that is not a cookie we set in your browser, but OpenRouter will see the request. Their policies apply when you use those features.

Fonts are loaded through Next.js. This app does not drop a Google Analytics cookie.

Your choices

• Turn on Do Not Track or Global Privacy Control to skip visit beacons.
• Use the browser’s site-data controls to delete cookies and localStorage.
• Do not sign in if you do not want a session cookie.
• Do not paste a key if you do not want it in localStorage.
• There is no in-app cookie settings panel and no consent banner — by design, for this hobby lab.

More on what we store: Privacy. The house rules: Terms.