Cookie Policy.
Cập nhật 29 tháng 8, 2026 · tiếng Anh có hiệu lực; các ngôn ngữ khác để tiện tham khảo
The website openfame.app sets no advertising cookie, no cross-site tracker and no analytics profile. Everything listed below is strictly necessary to sign you in or to take a payment safely, which is why you are not asked for consent and no banner is shown. This page exists so that the claim can be checked rather than believed: every cookie the site can set is named here, with who sets it, what it does and how long it lasts.
What is set, and by whom.
| Cookie | Set by | Domain | Purpose | Duration |
|---|---|---|---|---|
__Host-of_session | OpenFame | api.openfame.app | Keeps you signed in after you connect your X account. Signed and httpOnly, so no script can read it, and locked to this host by its name, so no other domain can set it | 30 days |
__Host-of_oauth | OpenFame | api.openfame.app | Holds the one-time state and verifier that make the X sign-in safe against interception, locked to this host by its name. Deleted the moment you land back on the site | 10 minutes |
__stripe_mid | Stripe | openfame.app | Fraud prevention: lets Stripe recognise the same browser across payment attempts. Set as soon as a payment form is opened | 1 year |
__stripe_sid | Stripe | openfame.app | Fraud prevention within a single payment session | 30 minutes |
__cf_bm | Cloudflare | openfame.app | Distinguishes people from automated traffic. Set only if bot management is enabled on the domain | 30 minutes |
Cloudflare Turnstile, which guards paid actions, is used in its cookieless mode: it issues a one-time token to the page and stores nothing on your device.
Why there is no consent banner.
European rules ask for consent before storing anything on your device that is not strictly necessary for a service you asked for. Authentication and fraud prevention are the two classic exemptions, and they are all that is on the list above. Adding anything outside them, a measurement tool that recognises returning visitors, an advertising pixel, a heatmap, would change that answer, and we would ask before setting it.
What we do not do.
No advertising or retargeting cookie. No pixel from a social network, including X. No analytics that builds a profile. No selling or sharing of anything about your visit. No fonts, scripts or images loaded from a third party that would reveal your address to them: the site serves its own.
How to refuse them.
Every browser can block or delete cookies, per site. Blocking the two OpenFame cookies means you cannot sign in, since being signed in is what they do. Blocking Stripe's means a payment may be refused or re-verified. Nothing else on the site depends on any of them: the board, the rules, the journal and the archive are readable with cookies switched off entirely.
What else is stored on your device.
One thing, and it is not a cookie. If you arrive through somebody's referral link, the referral code is kept in session storage until you close the tab, so that a purchase made a few minutes later still credits the person who sent you. It holds a number, it never leaves your browser except as part of a purchase you make, and closing the tab removes it. The same store keeps the name of the site you arrived from, when there was one, the domain name only, such as x.com, never the page, so that the house can tell which places bring buyers; it too leaves your browser only as part of a purchase you make, and closing the tab removes it. Nothing else is written to your device: no local storage, no IndexedDB, no service worker cache.
Who to ask.
Write to the address on the contact information, which is the only one and reaches a person. This page complements the privacy policy, which covers what is collected beyond cookies and the rights you have over it.