Cookies and other storage
- 1.1A cookie is a small record a browser stores and sends to the relevant site with requests. localStorage keeps browser records without automatic expiry; sessionStorage keeps them for a tab’s session. Neither storage API sends its contents to the server automatically.
- 1.2We use these technologies to secure sign-in, remember your requested language, carry invitations through sign-in and remember cookie choices. The sign-in cookie is HttpOnly; JavaScript can read the language and banner-choice cookies.
Complete storage inventory
| Name / storage | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
| df_session · cookie | DF League | Random opaque session token for account sign-in. HttpOnly, SameSite=Lax, Secure in production. | Necessary | Up to 12 hours; cleared on sign-out |
| df_oauth_<20 characters of state hash> · cookie | DF League / WorkOS sign-in binding | Binds each sign-in attempt to this browser; the PKCE verifier stays in server-side Redis. HttpOnly, SameSite=Lax, Secure in production. | Necessary | 10 minutes; cleared when the return is handled |
| dfl-signed-out · cookie | DF League | Prevents sign-in immediately restarting after returning from WorkOS sign-out. | Necessary | 10 minutes; cleared earlier on the matching redirect |
| dfl-lang · cookie | DF League | Remembers the requested kk, ru or en language. | Language preference | 1 year; renewed when a language is selected |
| dfl-lang · localStorage | DF League | Additional browser language preference. | Language preference | No automatic expiry; until browser data is cleared |
| dfl-invitation · sessionStorage | DF League | Carries an invitation token from the URL fragment into the account after sign-in; not a tracking identifier. | Necessary | Tab session; cleared earlier when the stored link is accepted or dismissed by the user |
| dfl-cookie-consent · cookie | DF League | Remembers the notice choice as v1.all or v1.necessary. | Necessary | 1 year; renewed on a new choice |
WorkOS and Google Fonts
- 3.1The site sets the listed df_oauth_… and df_session cookies on its own domain. This application does not set WorkOS SDK cookies named wos-session or wos-auth-verifier: the encrypted provider session stays on the server.
- 3.2On WorkOS’s separate hosted sign-in page, the provider may set its own sign-in and security cookies on its domain. Their names and lifetimes depend on its current configuration; this site’s code does not define or verify them. Refer to that page’s notice; our banner does not manage them.
- 3.3Google Fonts receives your IP and technical request information when fonts load. This is not a browser-storage key or an analytics or advertising integration on our site. Requests occur independently of cookie choices. See the Privacy Policy.
Managing your choices
- 4.1“Accept” saves v1.all and “Necessary only” saves v1.necessary for one year. Currently both use the same set: sign-in, security, requested language and remembering the decision. There is no analytics or advertising.
- 4.2The footer’s “Cookie settings” link reopens the choices. Your browser settings let you separately delete or block cookies, localStorage and sessionStorage. Deleting a cookie does not automatically erase an existing server-side account.
- 4.3Blocking cookies can prevent sign-in or invitation handling, reset language or make the banner reappear. The dfl-lang cookie and localStorage entry are separate: clear both to fully reset language. Links with ?lang=ru or ?lang=en determine the language of that public page.
Changes and contact
- 5.1Version 1.0 takes effect on 17 October 2026. If technologies or purposes change, we will update the inventory and obtain any additional consent needed. Your earlier choice will not count as permission for new analytics or advertising.
- 5.2Operator: DF League. Questions: alikhan.ryspay@gmail.com. See the Privacy Policy for data rights and response periods.