HomeLegal
Cookies Policy
The cookies and similar technologies Clubhouse AC uses, why we use them, how long they last and how you can control them.
- Last updated
- November 2, 2026
- items enumerated
- 10
No ad-tech, no cross-site profiling
On this page
What we use, at a glance
Clubhouse AC uses strictly-necessary cookies to keep you signed in, protect against CSRF, remember your 2FA verification and prevent abuse. We optionally load privacy-conscious analytics (Vercel Analytics, cookieless by default) if you accept it in the cookie banner. We do not use ad-tech cookies, cross-site profiling, third-party advertising pixels or session-recording tools.
Categories
Strictly necessary.
Required to run the site: authentication, session security, CSRF protection, rate limiting, 2FA verification, ban enforcement and your recorded cookie preference. These cannot be disabled; the site would not function without them. Legal basis: Article 6(1)(f) legitimate interests (site security and providing a functional service), plus ePrivacy Directive Article 5(3) exemption for strictly-necessary cookies.
Preferences.
Store non-tracking UI choices (theme, locale) in browser localStorage. Not HTTP cookies. Legal basis: legitimate interests / performance of contract.
Analytics (optional).
Loaded only after you accept it in the cookie banner. Article 6(1)(a) consent, withdrawable at any time.
Per-cookie enumeration
__Secure-clubhouseac-auth.session_token
Strictly necessarySession identifier for Better Auth. Keeps you signed in and links your requests to your account server-side.
- Duration
- Session-bound; extended on active use, expires when the session ends or you sign out.
- Vendor
- First-party (Clubhouse AC)
__Secure-clubhouseac-auth.session_data
Strictly necessaryEncrypted session payload that lets the server verify your session without a database roundtrip on every request.
- Duration
- Matches the session_token above.
- Vendor
- First-party (Clubhouse AC)
2fa_verified
Strictly necessaryConfirms you have completed the email OTP step required for every authenticated API request. Prevents credential-only attackers from calling protected endpoints.
- Duration
- 24 hours after successful 2FA verification.
- Vendor
- First-party (Clubhouse AC)
clubhouseac.csrf
Strictly necessaryCSRF token pairing that protects state-changing requests (form submissions, redemptions, admin actions) from cross-site forgery.
- Duration
- Session-bound.
- Vendor
- First-party (Clubhouse AC)
wt_lsid
Strictly necessaryRate-limit / abuse-prevention ledger. Never used for personal identification.
- Duration
- Rolling short-term window (typically hours to days).
- Vendor
- First-party (Clubhouse AC)
cookie-consent
Strictly necessaryRecords your cookie choice (accepted / rejected) so the banner does not re-prompt on every page.
- Duration
- 12 months.
- Vendor
- First-party (Clubhouse AC)
clubhouseac-theme (localStorage)
PreferencesRemembers your chosen colour theme (dark / light / system). Stored in browser localStorage, not a HTTP cookie.
- Duration
- Until you clear browser data.
- Vendor
- First-party (Clubhouse AC)
clubhouseac-locale (localStorage)
PreferencesRemembers your preferred language.
- Duration
- Until you clear browser data.
- Vendor
- First-party (Clubhouse AC)
clubhouseac-cookie-consent (localStorage)
Strictly necessaryMirrors the cookie-consent HTTP cookie above for consistent client-side reads.
- Duration
- Until you clear browser data.
- Vendor
- First-party (Clubhouse AC)
Pageview beacon (no cookie set)
AnalyticsFirst-party pageview measurement. A tiny beacon POSTs the current URL path, the referring host and (only when you accept the analytics category) a short-lived same-day session identifier derived from a daily-rotating salt applied to your IP address and browser type. No third-party service receives any of this data; it is stored in our own database and read only by the Clubhouse AC operator through the admin dashboard.
- Duration
- The beacon itself sets no browser cookie. Server-side records are retained for 90 days when the analytics category is accepted, or up to 400 days as anonymous aggregate counts otherwise.
- Vendor
- First-party (Clubhouse AC)
How to change your choice
Delete the cookie-consent cookie in your browser's site-data settings. The banner will reappear on your next visit so you can decide again. You can also use your browser's cookie controls to block or delete any specific cookie, but blocking a strictly-necessary cookie will prevent parts of the site from working (for example you will not stay signed in). Signed-in users can sign out at any time to remove the session cookies.
Do Not Track and Global Privacy Control
We do not load optional analytics unless you affirmatively accept it, so a browser sending a DNT or GPC signal without accepting the analytics category will not be tracked. If we ever add optional trackers that are enabled by default (we do not currently plan to), we will honour DNT and GPC as an opt-out signal.
Questions
Contact [email protected] or see the Privacy Policy for the wider data-processing picture.