Cookie Policy
osu!gacha · Last updated 14 August 2026
This is the full declaration of everything osu!gacha stores on your device. There are two cookies and a handful of browser storage keys, all of them first party. We do not use analytics, advertising or tracking cookies of any kind.
1.What cookies and local storage are
A cookie is a small file a site asks your browser to keep and send back on later requests. Local storage is a similar mechanism, except the data stays in your browser and is read by the page rather than sent automatically. Consent law treats both the same way, so both are declared here.
This declaration was last updated on 14 August 2026.
2.Why the game asks before it loads
osu!gacha cannot work without storing a session cookie: the server has no other way to know which collection to load and save. So instead of quietly setting cookies and offering a fake choice, we ask first and lock the game until you decide.
- Accept — we set the cookies below and the game becomes playable.
- Reject — we sign you out, clear the browser storage we control, and the game stays non-interactive. If you then try to interact with it, the prompt comes back, because accepting is the only way to continue.
- Either way, the Terms, Privacy Policy and this Cookie Policy stay fully readable, and nothing beyond the record of your choice is stored while cookies are rejected.
You can change your mind at any time with the "Cookie settings" link in the footer. Withdrawing consent signs you out again; your collection stays safely on our server and comes back when you sign in.
3.Cookies we set
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
osu_gacha_session | osu!gacha (first party) | Keeps you signed in. Stores an encrypted, signed record of your osu! user ID, username and avatar URL so the server knows which account a request belongs to. HttpOnly, so it cannot be read by scripts, and it is not readable by anyone else. | Strictly necessary | 30 days, refreshed while you keep playing |
osu_oauth_state | osu!gacha (first party) | A one-time random value used to protect the osu! sign-in flow against cross-site request forgery. It is deleted as soon as you return from osu!. | Strictly necessary | 10 minutes |
4.Browser storage we use
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
osu_gacha_cookie_consent | osu!gacha (first party) | Records whether you accepted or rejected cookies, and the version of this policy you were shown, so we do not ask again on every page. Storing your choice is what lets us honour it. | Strictly necessary | Until you clear your browser storage |
osu_gacha_dismissed_notices | osu!gacha (first party) | Remembers which in-game announcement pop-ups you ticked 'don't show again' on. | Functional | Until you clear your browser storage |
osu-gacha-animation-toggle | osu!gacha (first party) | Remembers whether you turned the pack-opening animation off. | Functional | Until you clear your browser storage |
osu_gacha_collection, osu_gacha_packs, osu_gacha_last_regen, osu_gacha_used_codes, osu_gacha_favorites | osu!gacha (first party) | Legacy keys from an earlier offline version of the game, where your collection lived only in your browser. Your collection is now stored on our server against your osu! account. These keys are no longer written to, and they are cleared if you reject cookies. | Functional | Until you clear your browser storage |
None of these keys leave your browser. They are not sent to our server and cannot be read by other sites.
5.Third-party cookies
We do not embed third-party trackers. A few external services are contacted while you play, and they may set their own cookies under their own policies:
- osu! (ppy Pty Ltd) — when you sign in, you are sent to osu.ppy.sh, which uses its own cookies to log you in there. Player avatars are also loaded from a.ppy.sh.
- Supabase — serves signed-card images from our storage bucket through time-limited links.
- Ko-fi and Discord — only if you click through to them from the footer or an announcement.
We have no control over cookies set by those sites once you are on them.
6.What we do not use
- No analytics or measurement cookies.
- No advertising, retargeting or cross-site tracking.
- No fingerprinting, session recording or heatmaps.
- No data brokers, and no selling or sharing of anything stored on your device.
7.Managing your choice
- Use the "Cookie settings" link in the footer to accept or withdraw consent at any time.
- Every browser also lets you block or delete cookies and clear site data in its settings. Doing that signs you out and, because our cookies are strictly necessary, makes the game unplayable until you accept again.
- Clearing your browser storage also erases your recorded choice, so the prompt will appear again on your next visit.
We honour Global Privacy Control and "Do Not Track" signals in the sense that we run no tracking to disable in the first place; they do not affect the strictly necessary cookies, without which the Service cannot run.
8.Changes
If we add, remove or repurpose anything stored on your device, we update this declaration and, where the change is material, ask for your consent again.
9.Contact
Questions about cookies, or about the data behind them? Email miztosu@gmail.com, or read the Privacy Policy for the full picture of what we store on our side.