Cookie Policy | Storybook RPG

What Are Cookies?

Cookies and similar browser storage help us keep you signed in, remember your choices, measure how the site is used, and support advertising. Optional analytics and advertising tools load only when you allow the relevant category. Our own first-party measurement, described below, stores nothing new on your device.

Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the website to function. They cannot be disabled.

auth_token - Your Firebase authentication token (expires: 30 days or session)
__session - Your secure server-side sign-in session (HTTP-only; expires: 14 days)
user - Your profile data (expires: 30 days or session)
recent_auth - Recent authentication indicator (expires: up to 1 day; some checks use a shorter version)
sb_returning - Remembers that this browser has signed in to an account before, so a signed-out visit is offered sign-in rather than sign-up. It stays after you sign out, and our first-party measurement reads it to tell a returning member's visit from a new visitor's (expires: 1 year)
cookie-consent - Your analytics and advertising choices, including whether Global Privacy Control was enabled when you saved them, and, once you sign in, a short fingerprint of the choice last sent to your account so it is sent again only when it changes (expires: 1 year after you made the choice)

Performance/Analytics Cookies

These cookies help us understand how you use our service so we can improve it.

Firebase Analytics - Page views, feature engagement, performance, account-provider information, content identifiers, visibility, counts, and broad categories. We do not send story titles, character names, prompts, or search text.
Server-side Google Analytics - A general image-generation event with the model, provider, content type, and product surface; it does not include the prompt, content title, entity identifier, or account identifier
These analytics events do not operate until you allow analytics

Advertising Cookies

These cookies and scripts help us deliver ads and measure advertising campaigns.

Reddit Pixel - Page visits and general conversion events such as signup, checkout, purchase, search, and story or character creation. We do not send story titles, character names, or search text to Reddit.
Reddit Conversions API - With your advertising consent, our server also reports your sign-up and purchases to Reddit. A report can include: a hashed copy of your email address; a pseudonymous account identifier (a keyed hash of your account ID, never the ID itself); the Reddit click ID from the ad you followed; the Reddit Pixel's browser identifier (the _rdt_uuid cookie), when the pixel has set one; for a sign-up, the IP address and browser of the request you signed up from, or of the request that saved your consent if you gave it after signing up; for a purchase, its value, currency, and a hashed purchase identifier used as the order ID; and conversion identifiers that let Reddit match these reports to the Pixel's. An enabled Global Privacy Control signal turns this off. Our server honours the signal on your sign-up and checkout requests and when you save your cookie choices, and when you sign in or return to the site signed in, a browser where you have saved a cookie choice brings your account up to date with that choice and the signal.
Google AdSense - Ad delivery and measurement on eligible pages
These scripts do not load until you allow advertising
An enabled Global Privacy Control signal keeps advertising tracking off

First-Party Measurement

We run our own measurement to see how people find and use Storybook RPG, and where it lets them down. It stores nothing new on your device: it sets no cookie, uses no local storage, and keeps no identifier there. The only thing it reads from your device is the sb_returning cookie listed above.

What it records:

Pages and steps visited - Recorded as page types, not full addresses (a character page, not which character)
Sign-up, sign-in, and checkout steps - Which steps you reached and whether each one worked
Errors - Problems you run into, as error codes and short technical descriptions, never what you typed
Device class - Phone, tablet, or computer; operating system; browser family; and whether you are browsing inside another app
Window size - A broad size band for your browser window, from phone-sized to wide desktop, not its exact dimensions
Language and time zone - Your browser language and time zone
Returning member - Whether this browser has signed in before (the sb_returning cookie)
Campaign tags - The site or campaign that brought you here, such as utm_source, and whether the link carried an ad click ID

To connect the steps of one visit without storing anything on your device, our server derives a pseudonymous key from your IP address and browser, and that key changes every day. Your raw IP address is not stored. When you are signed in, these events are linked to your account. When you sign up, the visit that led to it is linked to your new account too: its events are matched by that day's pseudonymous key and by the visit's session, which exists only in your open page's memory.

Raw events are kept for up to 400 days. A summary of each member's journey is kept with the account until the account is deleted, including what brought you (campaign tags, referring site, and landing page), when you first reached milestones such as your first message or first checkout, your plan and payments, and which days you were recently active. We use events and summaries only to run and improve the service. They are never shared with anyone and never used for advertising. (The Reddit click ID saved with your sign-up, described under Local Storage, reaches Reddit only through the Conversions API described above, with your advertising consent.)

Local Storage

We also use browser-local storage for these categories:

Authentication - Firebase Authentication persistence, temporary sign-in state, login hints, and redirect destinations
Content and feature state - Unsaved creation drafts, chat state, and other information needed to restore work or a feature after navigation
Interface preferences and caches - Display choices and short-lived local caches that make the app responsive
Display history - Local records used to avoid showing the same news item or ad too frequently
Cookie choices - A local copy of your analytics and advertising choices, with the same fingerprint as the cookie-consent cookie, which expires after one year
sbai_first_touch - Your first visit that came from a campaign or another site: its campaign tags, ad click ID, referring site, and landing page. It is sent with your sign-up so we know what brought you, together with the same details of the campaign link you signed up from (held only in the open page's memory), and kept until you clear your browser storage.
sbai_purchase_events_v1 - The purchases already reported to analytics or advertising tools from this browser, so a refreshed page does not report the same purchase twice

Managing Cookies

You can control cookies through:

Cookie Controls - Accept, reject, or change non-essential analytics and advertising choices
Browser Settings - Most browsers allow you to refuse or delete cookies
Global Privacy Control - Enable GPC in a supported browser to keep advertising tracking off. We honour it in the browser, and on our server as described under Reddit Conversions API above

Note: Blocking strictly necessary cookies may affect the functionality of our service.

Contact Us

If you have questions about our use of cookies, please contact us at jiiro@storybookrpg.com.