Cookie Policy
Every cookie BetterThanYou.lol sets, what it does, how long it lasts, and how to turn off the optional ones — which is all of them except the ones that make signing in work. Version 2026-08-22.
1. What this page covers
A cookie is a small file a site asks your browser to keep. The law does not care about the file format: Art. 5(3) of the ePrivacy Directive covers anything stored on or read from your device, so local storage counts too, and both are listed below.
Two categories, and only two. Strictly necessary storage, which the site cannot work without and which needs no consent. And analytics, which needs your consent and does not happen until you give it. There is no third category here: no advertising cookies, no marketing pixels, no social widgets, no fingerprinting, no data sold to anybody.
2. How we ask
Where analytics are available you get a banner, once, before anything optional is stored. It is built to the rules rather than around them:
- Nothing optional runs before you answer. Refusing is not a matter of switching off a script that already loaded — until you accept, the analytics tag is not in the page at all, so nothing is requested from Google and your IP address never reaches them.
- “No thanks” is one click, in the same size button as “Allow”. Consent that is harder to refuse than to give is not freely given (Art. 4(11) GDPR).
- Nothing is pre-ticked, and nothing counts as an implied yes. Scrolling, clicking around the site, or ignoring the banner all leave the question unanswered, which means off.
- Withdrawing is as easy as consenting (Art. 7(3) GDPR): the control in section 6, or Cookie choices in the footer of every page. It takes effect immediately, without a reload — the tag is told to stand down and the cookies it wrote are deleted.
- We ask again after 180 days. Not sooner, so a “no” is not nagged at; not never, because consent kept alive indefinitely stops being a current choice.
3. Strictly necessary — no consent needed
These are set because you asked for something that cannot happen without them: signing in, and being protected while you do. They carry no analytics and build no profile. Under Art. 5(3) ePrivacy they are exempt from consent, which is why they are set whether or not you answer the banner. On HTTPS the names below carry a __Secure- or __Host- prefix, which is the browser enforcing that they only ever travel over an encrypted connection.
| Cookie | Purpose | Duration |
|---|---|---|
authjs.session-token | Keeps you signed in. Without it, login is impossible. | 30 days |
authjs.csrf-token | Protects sign-in forms against cross-site request forgery. | Session |
authjs.callback-url | Returns you to the right page after signing in. | Session |
authjs.pkce.code_verifier, authjs.state | Only during “Sign in with Google”: proves the reply came back from the same sign-in you started. | 15 minutes |
You can block these in your browser, and you are entitled to. The board still reads normally; signing in and bidding stop working.
4. Analytics — only if you say yes
We would like to know how many people visit and which pages they read, using Google Analytics 4 (measurement ID G-QT7FHEV6DL). That is a want, not a necessity, so we ask first and take no for an answer.
Legal basis: your consent — Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy. Recipient: Google Ireland Limited, which transfers data to Google LLC in the United States under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. If you accept, these are set:
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes one browser from another so visits can be counted. | 2 years |
_ga_QT7FHEV6DL | Keeps the session state for this property. | 2 years |
Advertising is switched off in the tag itself: ad_storage, ad_user_data and ad_personalization are all denied, so the measurement cannot quietly turn into an advertising profile, and IP addresses are anonymised. What Google does with what it receives is governed by its own terms; what it does not get to do is build an advertising profile out of your visit here.
5. Not a cookie, but stored on your device
Your answer to the banner is kept in your browser's local storage under bty.analytics-consent: the decision itself, the version of this notice it was given against, and the date. It exists so that we stop asking, and so that a refusal is remembered rather than quietly forgotten on the next page.
Local storage never travels with a request, so unlike a cookie this one is never sent to us. Recording a choice you made yourself is strictly necessary under Art. 5(3) ePrivacy, so it does not itself require consent. Clearing your browser data clears it, and the question comes back.
6. Your choice, right here
The same decision as the banner, on the page that explains it. It applies to this browser, and takes effect the moment you press it.
Your browser can also block or delete cookies for this site directly — every major browser has the setting under privacy — and that overrides anything chosen here. If you delete the analytics cookies while analytics are still switched on, they are simply set again on your next visit.
7. Cookies set elsewhere
When you pay you are sent to a checkout page hosted by Stripe, and if you use “Sign in with Google” you are sent to Google. Both set their own cookies — for fraud prevention and for authentication — under their own policies and on their own domains, not ours, and not through this banner. We cannot switch those off for you: they are part of using those services at all.
8. Questions, and complaints
Who we are, what else we process and every right you have over it are set out in the Privacy Policy. For anything on this page, write to info@betterthanyou.lol. If you think we have handled it badly you can complain to the Garante per la protezione dei dati personali, or to the authority where you live.
9. Changes
If what we store changes, this page changes with it and the version date moves. Where the change is material we ask again rather than assume an old yes still covers it — a decision taken against a different description is not consent to the new one.