Cookie Policy
Everything we put on your device, listed individually. Most of it is not a cookie at all — modern web apps store things in your browser rather than sending them back and forth on every request — but the rules are the same either way, so we treat them the same here.
Your choice
There is one decision to make: analytics and ad measurement, yes or no. Everything else is needed to make the site and the game work, cannot be switched off without breaking them, and does not need your permission under the law.
"Measurement" means two things, and your one answer covers both: seeing which parts of the site and the game are used and where they run slowly, and seeing whether an advert we bought for thefinal brought you here. It never means building a profile of you or showing you adverts — we show none, and we have told Google not to use any of this for personalisation.
It is off until you turn it on. Nothing loads, runs, or is stored before you choose — and choosing "Reject" is a complete answer, not a delay before we ask again on the next page.
Strictly necessary
Always active. These carry no advertising or tracking value and exist only to make the thing you asked for work.
| Name | Where | What it does | Lasts |
|---|---|---|---|
thefinal.consent |
Local storage · both sites | Remembers the measurement choice you made above, so we stop asking. | 12 months |
thefinal.profile.v1 |
Local storage · game | Your display name and age confirmation, so the app knows you finished registering without asking the server on every load. | Until sign-out |
thefinal.returning.v1 |
Local storage · game | Marks you as a returning player, so you get the sign-in screen instead of the sign-up screen. | Until cleared |
| Firebase Authentication token | IndexedDB · game | Keeps you signed in between visits. Removing it signs you out. | Until sign-out |
| Firestore offline cache | IndexedDB · game | Holds your fixtures, cards and Score locally so the game survives a bad connection and does not re-download everything on every screen. | Until sign-out |
_GRECAPTCHA |
Cookie · set by google.com · game | Lets Google reCAPTCHA tell the real app apart from an automated script, so nobody can run up our costs or harvest other players' scores. It is a security check, not a measurement — it does not follow you around the web and it is not covered by the measurement choice above, because turning it off would leave the game undefended. | 6 months |
Analytics and ad measurement Consent required
Set only after you allow it. When you turn it off the tag stops sending, nothing here is set or read any more, and what is already on your device expires on its own or can be cleared by hand (see below). We use them to see which parts of this site and the game people actually use and where they run slowly, and — since September 2026 — whether an advert we bought for thefinal is what brought you here. Not to build a profile of you, and not to show you adverts: we show none, and Google is told not to use any of this for personalisation. The two sites share one measurement, so arriving here and then starting a game reads as one visit rather than two strangers.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
_ga |
Google Analytics 4 · both sites | Distinguishes one browser from another so a returning visit is not counted as a new one. Stored for thefinal.io as a whole, so this site and the game count you as one visitor rather than two. | 2 years |
_ga_<id> |
Google Analytics 4 · both sites | Keeps the state of the current visit (when it started, whether it is still going), including across the move from this site into the game. | 2 years |
_gcl_aw, _gcl_gs |
Google tag · both sites | Set when you arrive from one of our Google adverts: they hold the identifier of that click, so that if you then sign up we can tell Google Ads the advert worked. Both sites live under one domain, so the game reads the same cookie and the visit counts as one. They identify a click, not you, and nothing else reads them. | 90 days |
_gcl_au |
Google tag · both sites | The Google tag's own helper for the click cookies above; it may be set on any visit once you allow measurement, even one that did not come from an advert. It carries a random identifier for the browser and nothing about you. | 90 days |
| Firebase Analytics & Performance storage | Google, in the game only | The same measurement inside the app, plus page-load and network timings. Events are linked to your account identifier while you are signed in. | Up to 2 years |
| Cloudflare Web Analytics (stores nothing) | Cloudflare · both sites | Measures how fast pages actually load for real visitors. It is listed here because it only runs once you allow measurement, but it sets no cookie and writes nothing to your device — it sends one measurement and keeps no identifier, so there is nothing here for you to clear. | — |
Google keeps this data for 14 months and then deletes it. Google's own explanation of the data its analytics products collect is at policies.google.com.
What we don't use
Stated plainly, because "we may use cookies for various purposes" is the sentence every policy uses to avoid saying it:
- No retargeting or personalisation cookies. We show no adverts on either site and never build an advertising profile of you. We do buy adverts for thefinal elsewhere, and the only advertising-related storage is the three click cookies above — measurement, not targeting.
- No social media pixels or share widgets that phone home.
- No third-party fonts. Our typefaces are served from our own servers, so no font provider ever sees your IP address.
- No cross-site tracking, and nothing is sold or handed to data brokers.
When a page needs something from another company, we tell you here first. The tables above are that list in full: the Google tag and the Cloudflare measurement, neither of which is fetched until you allow measurement, and the Google security check that runs in the game whatever you choose. Nothing else on either site reaches out.
Controlling it yourself
You are not limited to the buttons above. Every browser can block or clear cookies and site data from its settings, usually under "Privacy". Clearing site data for thefinal.io removes your stored choice, so we will ask again on your next visit.
Be aware that clearing storage for play.thefinal.io also signs you out of the game and drops the offline cache. Your account and everything in it is safe on the server — you just sign in again.
More on how the two currencies, your account and the rest of your data are handled is in the Privacy Policy.