Cookie Policy
Everything we put on your device, listed individually. Most of it is not a cookie at all — modern web apps store things in your browser rather than sending them back and forth on every request — but the rules are the same either way, so we treat them the same here.
Your choice
There is one decision to make: analytics and ad measurement, yes or no. Almost everything else is needed to make the site and the game work and cannot be switched off without breaking them. The exception is two small cookies that remember where you came from: they are not necessary, and we set them without asking — that section says why, and how to object.
"Measurement" means two things, and your one answer covers both: seeing which parts of the site and the game are used and where they run slowly, and seeing whether an advert we bought for thefinal brought you here. It never means building a profile of you or showing you adverts — we show none, and we have told Google not to use any of this for personalisation.
Measurement is off until you turn it on: none of it loads, runs, or is stored before you choose — and choosing "Reject" is a complete answer, not a delay before we ask again on the next page.
Strictly necessary
Always active. These carry no advertising or tracking value and exist only to make the thing you asked for work.
| Name | Where | What it does | Lasts |
|---|---|---|---|
tf_consent |
Cookie · both sites | Remembers the measurement choice you made above — yes or no, and when — so we stop asking, and so the answer you give on one of our two sites applies on the other. It holds nothing else. | 12 months |
thefinal.consent |
Local storage · both sites | A copy of the same choice, used if your browser refuses the cookie above. | 12 months |
thefinal.profile.v1 |
Local storage · game | Your display name and age confirmation, so the app knows you finished registering without asking the server on every load. | Until sign-out |
thefinal.returning.v1 |
Local storage · game | Marks you as a returning player, so you get the sign-in screen instead of the sign-up screen. | Until cleared |
thefinal.locale.v1 |
Local storage · game | The language you chose for the game, so it opens in that language. Written only when you pick a language, or when your account already holds one. | Until cleared |
| Firebase Authentication token | IndexedDB · game | Keeps you signed in between visits. Removing it signs you out. | Until sign-out |
| Firestore offline cache | IndexedDB · game | Holds your fixtures, cards and Score locally so the game survives a bad connection and does not re-download everything on every screen. | Until sign-out, or the next visit by another account |
thefinal.firestoreCacheOwner.v1 |
Local storage · game | Which account the offline cache above belongs to — your account identifier, or nothing. When the next visit on this device is by someone else, or by nobody signed in, the game deletes the cache before reading anything, so one player’s cards never reach the next. | Until cleared |
_GRECAPTCHA |
Cookie · set by google.com · game | Lets Google reCAPTCHA tell the real app apart from an automated script, so nobody can run up our costs or harvest other players' scores. It is a security check, not a measurement — it does not follow you around the web and it is not covered by the measurement choice above, because turning it off would leave the game undefended. | 6 months |
_grecaptcha |
Browser storage · set by Google reCAPTCHA · game | The same security check keeping its working state on this device, so it does not have to start from scratch on every screen. Part of the check above, for the same reason and under the same rule. | Until cleared |
| App Check & app-installation storage | IndexedDB · Firebase · game | Holds the short-lived pass that proves requests come from the real app (renewed about every hour) and a random identifier for this installation of the app that the pass is issued to. Security, not measurement — nothing in it is about you. If you turn notifications on, the same identifier is the address they are delivered to (below). | Until cleared |
__telegram__initParams |
Session storage · set by Telegram's script · tg.thefinal.io only | Written by Telegram's own script, not by us: the launch data Telegram opened the game with — your Telegram user id, name, username and language, signed by Telegram — plus Telegram's version and colours, so the game still works inside Telegram after a reload. Outside Telegram it is written empty. Our server keeps only your Telegram user id from it (see the Privacy Policy). | Until the session ends |
__telegram__themeParams, __telegram__defaultColors, __telegram__isFullscreen, __telegram__isOrientationLocked |
Session storage · set by Telegram's script · tg.thefinal.io only | Telegram's colours and window state, kept by the same script. Nothing about you. | Until the session ends |
At tg.thefinal.io, where the game runs inside Telegram, the page also loads Telegram's script from telegram.org on every visit, which sends Telegram your IP address and browser details. It is needed to run the game inside Telegram, so it is not covered by the measurement choice; Telegram handles that request under its own privacy policy.
Where you came from Set without asking
These two cookies are not strictly necessary — the site and the game work exactly the same without them — and they are not covered by the measurement choice above. We set them on your first visit, whatever you answer, because we decided that knowing which links, searches and adverts bring players is worth it for everyone, not only for those who say yes. The law on device storage normally asks for consent here; we have chosen not to ask, and we say so rather than file them under "necessary".
| Name | Set by | What it does | Lasts |
|---|---|---|---|
tf_ft |
thefinal · both sites | Your first visit: when, which site and page, the name of the website that linked to you (not the full address), and any campaign tags and advert click identifiers in the link you followed. Written once. | 90 days, or until you sign up |
tf_lt |
thefinal · both sites | The same, for your most recent visit that came from a campaign link, an advert or another website. | 90 days, or until you sign up |
Only our own two sites read them; no other company does. When you create an account, the game sends them to us once, keeps a copy with your account, and deletes both cookies. What happens to that copy is in the Privacy Policy. You can clear them at any time (see below), and you can ask us to delete the stored copy by writing to [email protected].
Notifications Only if you turn them on
None of this exists until you tap to turn notifications on in the game and allow them in your browser. It is then needed to deliver what you asked for, which is why it asks nothing more of you. Turn either kind off with its switch on your profile page; blocking notifications for play.thefinal.io in your browser, or signing out there, stops them all on that browser. What we keep on our side is in the Privacy Policy.
| Name | Where | What it does | Lasts |
|---|---|---|---|
/push-sw.js |
Service worker · game | The small script your browser runs to show a notification when one arrives, in the game's language, and to open the fixture when you tap it. It contacts nothing on the internet. | Until cleared |
thefinal.push.v1 |
Cache storage · game | The wording of the two notifications in your language, so the script above can show them. Nothing about you. | Until cleared |
thefinal.pushPrefs.v1 |
Local storage · game | Your two switches for this browser and the account they belong to, so your profile page shows them without asking the server. | Until sign-out |
thefinal.pushAsk.v1 |
Local storage · game | When you last answered "Not now" to the offer of notifications, so it stays away for 30 days. Written only if you do. | Until cleared |
| Firebase Messaging storage | IndexedDB · Firebase · game | The browser's notification subscription for the game, kept by Google's messaging library so it can renew it. | Until sign-out |
Turning notifications on also makes the game talk to Google's Firebase messaging service, which delivers them, and your browser to its own push service. Neither runs before you turn them on.
Analytics and ad measurement Consent required
Set only after you allow it. When you turn it off the tag stops sending, nothing here is set or read any more, and what is already on your device expires on its own or can be cleared by hand (see below). We use them to see which parts of this site and the game people actually use and where they run slowly, and — since September 2026 — whether an advert we bought for thefinal is what brought you here. Not to build a profile of you, and not to show you adverts: we show none, and Google is told not to use any of this for personalisation. The two sites share one measurement, so arriving here and then starting a game reads as one visit rather than two strangers.
| Name | Set by | What it does | Lasts |
|---|---|---|---|
_ga |
Google Analytics 4 · both sites | Distinguishes one browser from another so a returning visit is not counted as a new one. Stored for thefinal.io as a whole, so this site and the game count you as one visitor rather than two. | 2 years |
_ga_<id> |
Google Analytics 4 · both sites | Keeps the state of the current visit (when it started, whether it is still going), including across the move from this site into the game. | 2 years |
_gcl_aw, _gcl_gb, _gcl_gs |
Google tag · both sites | Set when you arrive from one of our Google adverts (_gcl_gb is the form Google uses for clicks from some Apple devices): they hold the identifier of that click, so that if you then sign up we can tell Google Ads the advert worked. Both sites live under one domain, so the game reads the same cookie and the visit counts as one. They identify a click, not you, and nothing else reads them. |
90 days |
_gcl_au |
Google tag · both sites | The Google tag's own helper for the click cookies above; it may be set on any visit once you allow measurement, even one that did not come from an advert. It carries a random identifier for the browser and nothing about you. | 90 days |
| Firebase Analytics & Performance storage | Google, in the game only | The same measurement inside the app, plus page-load and network timings. Events are linked to your account identifier while you are signed in. | Up to 2 years |
| Cloudflare Web Analytics (stores nothing) | Cloudflare · both sites | Measures how fast pages actually load for real visitors. It is listed here because it only runs once you allow measurement, but it sets no cookie and writes nothing to your device — it sends one measurement and keeps no identifier, so there is nothing here for you to clear. | — |
Google keeps this data for 14 months and then deletes it. Google's own explanation of the data its analytics products collect is at policies.google.com.
What we don't use
Stated plainly, because "we may use cookies for various purposes" is the sentence every policy uses to avoid saying it:
- No retargeting or personalisation cookies. We show no adverts on either site and never build an advertising profile of you. We do buy adverts for thefinal elsewhere, and the only advertising-related storage is the click identifiers in the cookies above — measurement, not targeting.
- No social media pixels or share widgets that phone home.
- No third-party fonts. Our typefaces are served from our own servers, so no font provider ever sees your IP address.
- No cross-site tracking, and nothing is sold or handed to data brokers.
When a page needs something from another company, we tell you here first. The tables above are that list in full: the Google tag and the Cloudflare measurement, neither of which is fetched until you allow measurement, the Google security check that runs in the game whatever you choose, Google's messaging service once you turn notifications on, and Telegram's script on tg.thefinal.io, the game's Telegram version. Nothing else on either site reaches out.
Controlling it yourself
You are not limited to the buttons above. Every browser can block or clear cookies and
site data from its settings, usually under "Privacy". Clearing site data for
thefinal.io removes your stored choice, so we will ask again on your next visit to either
site, and
removes tf_ft and tf_lt too.
Be aware that clearing storage for play.thefinal.io also signs you out of the game, drops the offline cache and stops notifications on that browser. Your account and everything in it is safe on the server — you just sign in again.
More on how your account and the rest of your data are handled is in the Privacy Policy.
