Cookie Policy

Last updated: August 2, 2026

Ganbate (ganbate.io) is a free-to-play social casino. It is operated by Abraham Ahn, a sole proprietorship (not a corporation and not an LLC) ("we", "us", "our").

This Policy explains what we store on your device, why we store it, and how you can control it. It is written for the ganbate.io website, because cookies are a browser mechanism; installing Ganbate as a web app (PWA) changes nothing about what it stores or how you control it, since it is the same site running in your browser's engine. It forms part of our Terms of Service and should be read with our Privacy Policy, which explains what we do with personal data once we have it, and our Virtual Currency & Purchase Terms, which govern Coins.

Definitions

These two terms mean the same thing in every Ganbate document, and are reproduced word for word in each of them.

"Coins" are the virtual, in-game currency used to place in-game bets and to buy cosmetic items inside Ganbate. Coins are not money and are not your property. We grant you a limited, personal, non-exclusive, non-transferable, non-sublicensable, revocable licence to use Coins inside the Service, for entertainment, for as long as we choose to offer them. Coins have no cash value. They cannot be withdrawn, cashed out, redeemed, transferred between players, gifted, sold, or traded. There are no prizes of monetary value.

"Account" is the single Ganbate account you register with an email address, a username, and a password, and through which you use the Service. One person may hold one Account. An Account is personal to you: it may not be shared, sold, rented, gifted, traded, or used by anyone else.

1. The short version

1.1. Our own server sets two cookies. Both are strictly necessary. One keeps you signed in. One protects you from cross-site attacks. Neither is used for advertising or tracking.

1.2. We do not use analytics cookies. There is no analytics software on Ganbate at all — no Google Analytics, no tag manager, no tracking pixel, no session recorder.

1.3. We do show ads, and Google's ad script sets more cookies — once a certified consent dialog allows it. Ganbate loads Google AdSense, but not before Google's certified consent dialog has run and decided that it may (6.9). When it does load, Google sets its own cookies and identifiers through it — including some stored under the ganbate.io name. So if you open your browser's developer tools you will very likely see more than our two cookies. We do not control Google's, and we cannot delete them for you. See section 6.

1.4. We store settings on your device. Your theme, sound volume, favourite games and similar preferences are kept in your browser's local storage, not in a cookie, and are not sent to us.

1.5. If you block our cookies, Ganbate will not work. You will not be able to stay signed in or place a bet with your Coins. See section 9.

1.6. Two controls, and it matters which is which. What decides whether Google's ad script loads at all is a certified consent dialog, run by Google, that we put in front of it — not our cookie banner (6.9). What our banner decides is whether the ads are personalised. That answer is written to your device the moment you press the button, no account needed, and it is honoured. So "Reject Non-Essential" is a real control, but it is a de-personalisation switch and not an off switch: where ads may lawfully serve, they still serve — non-personalised — and Google still reads and writes on your device. Three limits worth knowing up front: the record is of a browser, not of a person; it does not delete what is already on your device; and it cannot take back a "yes" you gave to Google's dialog. See 6.9, 7.3 and 7.7.

1.7. There is no native app today — only the website and its installable PWA form. Installing Ganbate to your home screen does not change what is stored or how you control it: it is the same site in your browser's engine, using the same cookies (section 3) and the same controls throughout this Policy. There used to be an Android build with its own storage and a separate ad route; it has been withdrawn (6.11). If a native app returns, this Policy will describe its storage and controls before it ships.

1.8. Ganbate is for adults. You must be 18 or over to use it. Sign-up asks you to confirm that in a checkbox of its own, and we record that you did — but we do not verify it: no ID, no date of birth. The rule still rests on your own declaration. See section 11.

2. What cookies and similar technologies are

2.1. A cookie is a small text file that a website asks your browser to store and then sends back to that website on every later request. Cookies are how a website recognises that two requests came from the same browser — which is the only way to keep you signed in.

2.2. A cookie is called first-party when it is stored under the name of the site you are visiting (ganbate.io) and third-party when it is stored under someone else's domain (for us, Google's advertising domains). One thing worth knowing, because it surprises people and because it applies here: a third party's script running on our page can write first-party cookies too. "First-party" tells you which name the cookie is filed under — it does not tell you who wrote it or who it is for. Google's ad script does exactly this, and we spell it out at 6.4.

2.3. A session cookie is deleted when you close your browser. A persistent cookie stays until its expiry date or until you delete it.

2.4. HttpOnly means a cookie cannot be read by JavaScript running on the page, which protects it from being stolen by malicious scripts. Secure means it is only ever sent over an encrypted HTTPS connection. SameSite=Strict means your browser will not send it when a request comes from another website. On ganbate.io, both of the cookies we set use all three. (We cannot apply any of these to Google's cookies — see section 6.)

2.5. Websites can also store data on your device without cookies. Ganbate uses four such technologies, and this Policy covers them all:

• Local storage — key/value data saved in your browser. It stays until you clear it. It is not automatically sent to our servers.
• Session storage — the same, but wiped when you close the tab.
• IndexedDB — a small database in your browser. We use it to cache data you have already loaded so the app opens instantly and keeps working if your connection drops.
• Cache Storage (service worker) — a copy of the app's own files (page, code, images, fonts) so Ganbate loads fast and works offline.

2.6. Throughout this Policy, "storage" means all of these together.

3. Cookies we set

3.1. Ganbate's own server sets exactly two cookies. This is the complete list of the cookies we set. It is not the complete list of cookies you will find stored under ganbate.io, because two of Google's scripts run on our pages and store things of their own — the advertising script (some of its cookies under our domain name), and the consent dialog that gates it. We describe both honestly in section 6, and we do not want you to discover them in your developer tools and conclude we were hiding them.

3.2. Both are first-party, both are strictly necessary, and neither is used to profile you, track you across websites, or serve advertising.

3.3. Because they are strictly necessary, these two cookies are not subject to the consent banner, and we do not ask your permission for them. Without them there is no sign-in and no safe way to accept an action from you — the site simply cannot run.

3.4. Our legal basis for these two. If you are in the UK, the EU, or the EEA: storing them is "strictly necessary" to provide a service you have actively requested, which is the exemption in Article 5(3) of the ePrivacy Directive, so no consent is required. The underlying processing rests on contract (Art. 6(1)(b) UK/EU GDPR — we cannot sign you in without them) and on our legitimate interests (Art. 6(1)(f) — keeping your account secure against cross-site attacks). Our lawful basis for advertising is different, and we deal with it squarely in section 6.

3.5. Your access token is not stored. The short-lived token that authorises each request (valid for 15 minutes) is held in memory for as long as the tab is open. It is not written to a cookie, and it is not written to local storage. Reload the page and it is gone; the app uses the refreshToken cookie to obtain a new one.

3.6. We ourselves set no cookie for analytics, advertising, or measurement, and we do not sell, rent, or share our cookies with anyone. What Google's ad script does is a separate matter and is described in section 6 — we are not using this clause to smuggle past it.

4. What we store on your device (not cookies)

4.1. The following are kept in your browser's local storage. They stay until you clear your browser data. They are your settings and your device's copy of them — they are not transmitted to us with each request the way a cookie is.

4.2. Session storage. One key, chunk-reload-at, records the time of a one-off page reload after the browser failed to download part of the app (which happens when we deploy a new version while your tab is open). It exists to stop the page reloading in a loop. It is wiped when you close the tab.

4.3. IndexedDB. We keep a cache of data the app has already fetched for you — in a database named bslt-db, store bslt-cache — so the app opens instantly and continues to work if your connection drops. Because it is a copy of what the app fetched, it can include your own account data (for example your Coin balance or your notifications). It is stored under a key tied to the signed-in account, so one account's cached data is not restored into another's, and signed-out visitors share a separate anonymous cache. Cached entries are discarded after 24 hours. This cache stays on your device; it is not a copy we hold.

4.4. Cache Storage. Our service worker keeps a copy of the app's own files under the names static-…, assets-…, dynamic-… and api-…. It is replaced when we release a new version.

4.5. Clearing site data for ganbate.io in your browser removes everything in this section.

5. Analytics: we do not use any

5.1. Ganbate has no analytics cookies, because Ganbate has no analytics. We do not run Google Analytics, Google Tag Manager, Meta Pixel, Plausible, Mixpanel, Segment, Hotjar, or any comparable product. There is no tracking pixel and no session-recording tool anywhere on the site.

5.2. Nothing on Ganbate measures your behaviour for statistics, builds a profile of you, or follows you to another website on our behalf.

5.3. We do not ask you to consent to analytics, because there is nothing to consent to. The banner and the Settings screen used to carry an "analytics" switch, but it gated a script that does not exist — so we removed it rather than keep asking you to permit a tool we do not run. A tick that holds nothing back is worse than no tick at all. If we ever introduce analytics, we will update this Policy and ask you before it starts — a fresh choice made then, not one quietly banked in advance.

5.4. Error monitoring. We use no third-party crash-reporting service. The Sentry integration this Policy previously described — switched off, but present in the code — has been removed outright, along with the session-replay capability it shipped with. Nothing records your screen, and no error data leaves your browser for a third party. When something breaks, our own servers write a log entry; that is the whole of it. If we ever adopt such a service, we will update this Policy before it is switched on.

6. Advertising

6.1. Ganbate is free to play. Advertising is one of the two ways we pay for it (the other is Coin packs). You never have to watch an ad, and you never have to buy anything — free Coins are available every day at no cost, and Coins have no cash value in any case.

6.2. We use Google AdSense. When Google's certified consent dialog permits it (6.9), our pages load Google's advertising script from pagead2.googlesyndication.com. The only ad format our code ever asks for is an optional rewarded video ad: you choose to watch it, and we credit free Coins when it finishes. We have built no banner slots and no display slots anywhere in the app. We should be honest about the limit of that statement, because it is a statement about our code and not about Google's: what Google's script is permitted to serve is also governed by settings in the AdSense account, not only by what we ask for. So we can tell you what we request. We cannot promise you will never be shown anything else.

6.3. Once the script is allowed to load, Google's ad cookies can be set even if you never watch an ad. No ad script loads before the consent dialog has allowed it (6.9) — but the moment it does, the script loads, and our code immediately tells Google to pre-load an ad so that one is ready if you ask for it. So from that point Google's advertising cookies and identifiers can be placed on your device on a page view alone. Permitting ads is not the same as agreeing to watch one: it permits the script, and the script does not wait for you to press anything. We would rather state that plainly than let you assume the ad code stays dormant until you go looking for a reward. (One thing does run before you have answered anything: the consent dialog itself, which is also a Google script. We describe it at 6.9.2 rather than let you find it in your developer tools.)

6.4. They are Google's cookies — but some of them sit under our domain name. Google sets cookies from its own advertising domains (Google's documentation lists these; they include doubleclick.net). Google's publisher script also sets first-party cookies stored under ganbate.io. We want to be exact about what that means: they are written by Google's code, for Google's purposes, and we can neither read nor control them — but they will appear in your browser under our site's name, not Google's. Google and its advertising partners use them to serve ads, cap how often you see the same ad, measure whether an ad worked, detect ad fraud, and — unless you opt out with Google — personalise what you are shown.

We deliberately do not print their names and lifetimes in this Policy. They are Google's to choose and to change, they are set by Google's code at the moment it runs rather than by ours, and a list we copied out once would be a list that quietly goes stale and misleads you. We would rather send you to the two sources that are always current: Google documents these cookies at the first link in 6.6, and your browser's developer tools will show you exactly what is stored on your device right now.

6.5. In the UK, the EU and the EEA our lawful basis for advertising is consent — and it is collected before the script exists. There, advertising cookies are not "strictly necessary", so the law requires your consent (ePrivacy Art. 5(3); Art. 6(1)(a) UK/EU GDPR) before they are set. That is how it is built. There is exactly one place in our code that can create Google's ad tag; a certified consent dialog runs before it on every visit and decides whether it may exist. Where you are covered by GDPR, that dialog asks you, and if you refuse — or answer nothing, or the dialog never loads — no ad tag is ever created.

Two qualifications, because the sentence above is doing a great deal of work and we would rather you had it exactly. First: the dialog is the gate, not our cookie banner. The dialog is Google's, it is certified, and it is what the law actually recognises; our banner decides whether the ads are personalised, which is a different job (6.9). Second: where that dialog determines GDPR does not apply to you, consent is not the lawful basis and none is collected — the ad tag loads without asking you anything. 6.9 sets out both paths in full, including what they do not protect you from.

6.6. We do not control Google's cookies. We cannot see them, we cannot change how long they last, and we cannot delete them for you. Their names and lifetimes are set by Google and change from time to time. Google publishes what it uses:

• How Google uses cookies in advertising: https://policies.google.com/technologies/ads
• Google's Privacy Policy: https://policies.google.com/privacy
• Turn off ad personalisation across Google's services: https://myadcenter.google.com

6.7. Which control to reach for. Our own controls do real work now — the banner and the "Do Not Sell or Share" switch (12.3) decide whether the ads you are served are personalised, and they are honoured. But be clear about their reach: they bind Ganbate and only Ganbate, and they do not decide whether Google's script runs. The consent dialog decides that (6.9). Google's controls (6.6) reach further, because they sit with Google and apply across Google's services rather than just ours; and your browser (section 8) is the only thing that can stop the cookies being set at all. Pick the one that matches what you actually want, rather than assuming any of them does all three jobs.

6.8. We do not detect or penalise ad blockers. If you block Google's script, we do not nag you, degrade the site, or lock you out. See 9.5.

6.9. How the ad script is gated, stated plainly. There is one function in our code that can bring Google's ad tag into existence, and it cannot be called without naming the basis on which the ads would be served. A certified consent management platform — Google's own, Funding Choices, on the IAB TCF v2.2 framework — is what decides that, and we want to be exact about how, because a banner that takes credit for a gate it does not operate is its own kind of lie.

The dialog runs first, for everyone. Our code has a rule that would let it skip the dialog for a visitor it knows to be outside the UK and the EEA. It never uses that rule, because nothing in the page tells it where you are: we do not geolocate you in the browser, and an unresolved location is not treated as permission. Not knowing where you are is not a licence to advertise at you. So on every visit, from everywhere, the certified dialog is loaded first and alone, and the ad tag is loaded second or not at all. The dialog does its own geo detection — that, and not us, is what establishes whether you are covered by GDPR.

One thing to reconcile, before it looks like we are contradicting ourselves elsewhere. Our server does read a CDN's view of the country your request came from — that is the geographic block described in our Disclaimer (§4.2), and it is real. But that region is used to refuse a request, and it is never handed to the advertising code running in your browser. So the ad gate genuinely does not know where you are, and behaves accordingly: it asks the certified dialog, every time.

Then one of two things happens.

• The dialog decides GDPR applies to you (you are in the UK or the EEA). It asks you. The ad tag is created only if you tell it yes — specifically, only if you agree both to information being stored on your device and to Google as a vendor. If you refuse, if you close the dialog without answering, or if the dialog never loads at all, no ad tag is ever created. Not delayed, not non-personalised: absent.
• The dialog decides GDPR does not apply to you (you are, say, in California). Then the law is opt-out, not opt-in, and the ad tag loads without asking you anything. We would rather you read that twice than skim it: outside the GDPR area, no answer from you is required before Google's advertising script runs, and if you have not answered our banner, the ads are personalised by default.

Now the part people get wrong, and it is the part we most want to get right: our banner is not the gate. It cannot conjure the ad script and it cannot suppress it. What it does — in both cases above, always — is decide whether the ads are personalised. "Reject Non-Essential", and the "Do Not Sell or Share" switch (12.3), make them non-personalised. Two consequences follow, and both are limits rather than features:

• If GDPR does not apply to you, refusing on our banner does not stop Google's advertising cookies being set. It de-personalises the ads that are served over them. A non-personalised ad still reads and writes on your device; "non-personalised" is not "storage-free".
• If GDPR does apply to you and you have already told Google's dialog yes, refusing on our banner afterwards does not take that back (6.9.3). It de-personalises the ads.

If what you want is that Google's ad cookies are never set at all, the instrument for that is your browser, not our banner: block the script (8.6) or clear site data (8.5). Only your browser can make them impossible.

6.9.1. Changing your answer reloads the page. Google's script reads the personalisation setting once, as it starts up. So once it is running the setting cannot be changed underneath it — writing a new value would store a flag and change nothing, which is worse than offering no switch at all. When you change your answer and the script is already loaded, we therefore reload the page. That is the only honest way to make a new answer bite, and it is why the "Do Not Sell or Share" switch warns you that the page will reload.

6.9.2. The consent dialog stores something too, and it is Google's. The dialog described above is a Google script, loaded from fundingchoicesmessages.google.com. It runs before you have answered anything — which is lawful, because the mechanism that asks for consent is itself strictly necessary to obtain it, but we would rather you heard it from us than found it in your developer tools. It stores your consent answer on your device (as the IAB "TC string") so that it does not have to ask again on every visit. As with Google's advertising cookies (6.4), what it stores and for how long is Google's to decide, not ours, and we do not print a list here that would quietly go stale.

6.9.3. Taking back a "yes" you gave the dialog is not something our switches can do — and you should know that before you need it. The consent the dialog collects is held by the dialog, in its own record on your device. Our controls do not write that record and cannot erase it. So if you agreed in the dialog and later change your mind on our banner, or with the "Do Not Sell or Share" switch, what you get is non-personalised ads — not the disappearance of the ad script, because as far as Google's record is concerned you have still permitted the storage. This is a real limit and we are not going to bury it: to withdraw the permission itself, clear the site data for ganbate.io (8.5), which deletes that record along with everything else, and the dialog will ask you again from scratch on your next visit. Withdrawing consent must be as easy as giving it, and today the honest instruction is that one — not a switch of ours.

6.10. An advertisement on Ganbate is not an endorsement. See section 7 of our Disclaimer.

6.11. There is no native app, so there is no second ad route. Ganbate is a website, installable as a web app (PWA) but running the same browser advertising described above with the same controls. There used to be an Android build wrapped in a native shell, with a separate Google AdMob route; it has been withdrawn. All advertising now runs through the browser AdSense path and the certified consent dialog at 6.9. If we ship a native app in future — a mobile app that carries its own ad route with its own device controls — this clause will describe it before it ships, not after.

7. Your choices: the consent banner

7.1. On your first visit, a banner appears at the bottom of the page with three buttons:

• Accept All — records your consent to all three optional categories below. It does not, by itself, permit the advertising script: only the certified consent dialog can do that (6.9), and pressing this cannot bypass it or pre-empt it.
• Reject Non-Essential — records your refusal of all three, and makes any ad you are served non-personalised. It is not an off switch for Google's script: read 6.9 and 7.7 for what it does and does not reach.
• Manage — opens Settings → Data Controls, where you can set each category individually. Settings requires an account. The advertising opt-out that does not require one is the switch in the page footer — see 7.6 and 12.3.

7.2. The three optional categories are marketing email, third-party sharing, and profiling. Strictly necessary cookies (section 3) are not among them and cannot be switched off. ("Marketing email" is not a cookie setting at all; it is listed here only because the same banner sets it.) There is no analytics category, because there is no analytics — see section 5.

Advertising is third-party sharing and profiling together: a personalised ad both shares information about you with Google and profiles you, so both must be granted or we treat the answer as no. That is also what makes the "Do Not Sell or Share" switch coherent — an opt-out from "sale or sharing" has to revoke both of them, and it does.

7.3. What "recorded" means, and what it does not. Your answer is written to your device the moment you press the button — to your browser's local storage, under ganbate.consent.v1, with the date — and that is the copy our advertising code actually reads when it decides whether your ads may be personalised (6.9). It needs no account, and that is deliberate rather than incidental: the people being shown ads are mostly signed out, so a consent record that only a signed-in server could read would be a consent record that arrives too late to govern anything.

If you are signed in, the same answer is additionally mirrored to your account, which is the durable, auditable copy. If that mirroring fails, your choice still holds — the copy that governs the ads is the one on your device, not the one on our server.

Two things it is honest to say about that. It is a record of a browser, not of a person: answer on your laptop and your phone will still ask you. And if your browser refuses storage outright (private mode with storage disabled, say), your answer governs the page you are on and then is gone — we will ask again next time rather than assume you agreed. Asking twice is the right failure; assuming is not.

7.3.1. Answering while signed out works, and this is the case we most wanted to get right. The banner appears on your first visit, which is usually before you sign in — and that is precisely the visitor who is about to be shown an ad. Your answer is recorded, on your device, with no account, and it is what governs the ads you are then served. It was not always so: the banner used to try to file your choice against an account, which for a signed-out visitor meant it was filed nowhere at all, and the only thing that survived was a flag saying you had answered — not what you had answered. That is fixed, and the flag is gone (7.5).

What we are not claiming: a signed-out answer never reaches us. It lives in that browser and nowhere else. So we hold no server-side record of an anonymous visitor's choice, and we cannot carry it across to your other devices for you. That is a limit of the design, not a defect in it — but you are entitled to know which of the two it is.

7.4. Marketing email is controlled elsewhere — and that control does work. Whether we actually send you marketing email is decided by your email notification preferences and by the unsubscribe link in every marketing email, not by the banner's "marketing email" tick. If you want to stop marketing email, use the unsubscribe link or your notification settings; setting the banner alone is not enough today.

7.5. Where the answer is kept. Your decision is stored in your browser's local storage under ganbate.consent.v1 (section 4), and the banner shows until a decision exists — not until it has been dismissed. There is no separate "dismissed" flag any more. There used to be, and it was a mistake: dismissal and choice were two pieces of state that could disagree, so a banner you had closed could leave nothing recorded at all. One record now, and it is the one that does the work. Clearing your browser data clears it, and the banner will ask again.

7.6. Changing your mind. You can change any of these choices at any time at Settings → Data Controls (ganbate.io/settings/data-controls) — and the change takes effect there and then, not at some later visit: saving rewrites the same record our advertising code reads, and applies it immediately (6.9.1). What that reaches is the personalisation of your ads. What it does not reach is the permission you gave Google's consent dialog — for that, see 6.9.3.

Settings requires you to be signed in. So the advertising opt-out also sits in the page footer — and, on a phone, in the menu — where it works with no account at all. That is not a convenience; it is the whole point, and 12.3 explains why.

7.7. Three things the banner cannot do for you. First, it does not delete cookies that are already on your device. It governs what may be set from now on; it cannot reach back and remove what was set before. For that, clear your cookies and site data (8.5).

Second, refusing is not the same as blocking. "Reject Non-Essential" makes your ads non-personalised — it does not make Google's script vanish, and a non-personalised ad still reads and writes on your device. If your goal is that Google's ad cookies are never set at all, then the browser is the instrument and the banner is not: block the script (8.6), or clear site data (8.5). We would rather send you to the thing that actually achieves what you want than let a button take credit for more than it does.

Third, it is not the thing that decides whether Google's ad script may load. A certified consent dialog does that (6.9), and our banner cannot override it in either direction: pressing "Accept All" cannot let the script in where the dialog would have refused it, and pressing "Reject Non-Essential" cannot revoke a permission you already gave the dialog (6.9.3).

7.8. Refusing is free — and we mean free. Answering the banner is not a condition of using Ganbate, and we do not treat you differently for refusing: nothing in the game is locked behind "Accept All", no feature is withheld, no price changes, and the daily free Coins are untouched. You can play every game on Ganbate having refused everything.

That includes the one place you might expect a catch. The optional rewarded video credits free Coins when you watch it — and where there is no ad to watch, because you refused, or because you block ads, or because the consent dialog never let the script load, we credit the Coins anyway, after a short countdown in place of the advertisement. The reward is ours to give, and withholding it from someone who declined to be tracked would be a penalty on refusing consent. We do not impose one. (If an ad does play, you have to watch it to the end to be credited — that part is the deal you took.) Coins have no cash value in any case, and you never have to buy anything.

8. Managing cookies and site data in your browser

8.1. Your browser gives you the final say. You can block all cookies, block only third-party cookies, delete the cookies you already have, or wipe everything a site has stored on your device. You do not need our permission and you do not need to tell us. (This whole section is about browsers — which is all Ganbate runs in today, including its installable PWA form. If a native app returns, it will keep its own copy of this storage that browser settings cannot reach, and this section will say so; see 6.11.)

8.2. Blocking third-party cookies while allowing first-party cookies is a good middle setting, and most major browsers offer it in one click (several now do it by default). Ganbate keeps working, because our two cookies are first-party. But be aware of its limit: it blocks Google's cookies that come from Google's own domains, and it does not block the ad cookies Google's script writes under the ganbate.io name (6.4). To be rid of those as well, block the script itself (8.6) or clear site data (8.5). We would rather you knew the setting's limit than trusted it to do more than it does.

8.3. Blocking all cookies, or blocking first-party cookies for ganbate.io, stops Google's ad cookies completely — but it also stops you signing in. See section 9.

8.4. The controls are in your browser's settings, usually under "Privacy":

• Chrome — Settings → Privacy and security → Third-party cookies.
• Safari — Settings → Privacy.
• Firefox — Settings → Privacy & Security.
• Edge — Settings → Cookies and site permissions.

Your browser's own help pages have current, step-by-step instructions. We do not reproduce them here because they change.

8.5. To remove everything stored on your device under ganbate.io — our two cookies, any ad cookies Google's script has written under our domain, the consent dialog's record of what you told it (6.9.2), your banner answer, all local storage, session storage, the IndexedDB cache and the offline app cache — use your browser's "Clear cookies and site data" for ganbate.io. Private or incognito windows discard all of it automatically when you close them. (Cookies Google has set on Google's own domains are not covered by this; clear those in your browser's full cookie list, or use Google's controls at 6.6.) This is also the way to withdraw a consent you gave the dialog, and the reason 6.9.3 and 12.1 send you here: the dialog's record goes with everything else, and you are asked again from scratch.

8.6. Browser extensions and ad blockers can also block Google's ad script outright, which prevents its cookies from ever being set. We do not object to that, we do not detect it, and we do not penalise it — and, as 9.5 sets out, it does not cost you so much as a Coin.

9. What stops working if you block cookies or storage

9.1. We would rather tell you plainly than have you wonder why the site is broken.

9.2. If you block our two cookies, Ganbate does not work. Specifically:

• Blocking or deleting refreshToken — you will be signed out as soon as you reload the page, and you will have to sign in again every time. Staying signed in is impossible without it.
• Blocking _csrf — the site will refuse the actions that change something: placing a Coin bet, buying a Coin pack, posting in chat, or changing a setting. You may still be able to reach the sign-in screen, but you will not be able to play.
• Blocking all cookies for ganbate.io — Ganbate is unusable. Even where a sign-in gets through, nothing about you is remembered and every action is refused. There is no way around this: Ganbate requires cookies.

9.3. If you block local storage, the site still works, but it forgets you: your theme, volume, language and favourites reset on every visit, the cookie banner reappears every visit, and actions taken while offline cannot be queued and retried.

9.4. If you block the offline cache (service worker / IndexedDB), the site works but loads more slowly and will not work without a connection.

9.5. If you block Google's ad script or use an ad blocker, everything except the ads themselves keeps working — and that includes the Coins. The rewarded video has no advertisement to play, so we show a short countdown instead and credit the same free Coins at the end of it (7.8). The daily claim and the other free Coin sources never involved advertising in the first place, and no purchase is ever necessary. Blocking ads costs you nothing here: not the game, and not the Coins.

9.6. We do not detect ad blockers, and we do not restrict, penalise, or nag anyone for using one.

9.7. Nothing in this section is about money. Coins have no cash value. They cannot be withdrawn, cashed out, redeemed, transferred between players, gifted, sold, or traded. There are no prizes of monetary value. Blocking cookies cannot cost you money you have paid. See our Virtual Currency & Purchase Terms.

10. Do Not Track and Global Privacy Control

10.1. Browsers can send a "Do Not Track" signal. There is no agreed standard for what a website must do about it, and Ganbate does not currently respond to it. We would rather say so than imply a protection we do not provide.

10.2. Some browsers and extensions also send a Global Privacy Control (GPC) signal, which in California — and in Colorado and Connecticut — is treated as a legally valid opt-out of the sale or sharing of personal information. Ganbate detects and honours GPC.

10.3. What that means in practice: if your browser sends GPC, advertising is set to non-personalised before you are asked anything and before Google's ad script is configured. It applies with no account and no banner, it is read at the moment the tag is set up rather than trusted from a saved preference, and it overrides an earlier "yes" — a signal you are sending now says more than a box you ticked once. It is recorded as an opt-out as well, so the "Do Not Sell or Share" switch reflects the state you are actually in.

10.4. GPC is an opt-out of sale and sharing, and that is the whole of what we apply it to. It is not consent to anything, and it does not answer questions it did not ask — it leaves every other preference exactly where you left it.

11. Ganbate is for adults

11.1. You must be 18 or over to use Ganbate. It is not intended for children, and we do not knowingly allow anyone under 18 to hold an account or to play. This matches section 2 of our Terms of Service.

11.2. We do not knowingly store cookies or other data on the device of anyone we know to be under 18, and we do not knowingly allow advertising to be personalised to them. If you believe a child has used Ganbate, email [email protected] and we will delete the account and the data associated with it.

11.3. We ask you, and we record your answer — but we do not verify your age. You should know exactly how strong the 18+ rule is, because the difference between asking and verifying is the whole of it. When you register, a checkbox of its own — separate from the one about the Terms — asks you to confirm: "I am 18 or older, and I am not a resident of Washington State." You cannot submit the form without ticking it, and it is not decoration: our server refuses to create the account unless that confirmation actually arrived with the request, and it records which version of those words you agreed to, and when.

What that is not is verification. There is no date-of-birth field, no ID check and no document check anywhere in Ganbate. We check that you said it. We cannot check that it is true, and someone willing to lie will get in. So 11.1 and 11.2 still rest on your own declaration — it is now an explicit, recorded declaration rather than a clause buried in a document you may never have opened, which is better, but it is not an age check and we will not call it one.

12. Your rights over what we store

12.1. If you are in the UK, the EU, or the EEA. You may withdraw consent at any time, object to processing based on our legitimate interests, and ask for a copy of your data or its deletion. Our lawful bases for the cookies we set are in 3.4, and for advertising in 6.5: consent, collected by a certified consent dialog before the advertising script is permitted to exist.

On withdrawal we owe you a straight answer rather than a comfortable one. Our own controls (7.6, 12.3) will de-personalise your ads immediately, but they cannot delete the permission the consent dialog holds — that record is Google's, and ours do not write it. To withdraw the consent itself, clear the site data for ganbate.io (8.5): the dialog's record goes with it, and you will be asked again, from scratch, on your next visit. That is a worse experience than a button of ours would be, and we would rather hand you the instruction that works than the button that does not. See 6.9.3. The full description of your rights, and how to exercise them, is in our Privacy Policy.

12.2. If you are in California. You have the right to know what personal information is collected about you, to have it deleted, to correct it, and — most relevantly here — the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising. We do not sell your personal information for money. However, loading Google's advertising script is very likely "sharing" as the CPRA defines it, and we are not going to pretend otherwise.

12.3. How to opt out: the switch, where it is, and what it does. There is a "Do Not Sell or Share My Personal Information" switch in the product. It is in the page footer on desktop, in the menu on a phone, and in Settings → Data Controls if you are signed in. In all three places it is the control itself and not a link to one, and — the part that matters — you do not need an account and you do not need to sign in to use it. California (§7026) forbids making a consumer log in to opt out, and our Settings screen is behind a login, so the switch is carried where a signed-out visitor can actually reach it. A signed-out visitor is, after all, exactly who is being served the ads.

What it does when you press it: it records that personalised advertising is refused, and it applies that immediately rather than at some future visit — the page reloads, because that is the only way the change genuinely reaches Google's already-running script (6.9.1). From then on, ads are non-personalised.

What it does not do, said plainly, because an opt-out that is oversold is worse than none. It does not stop ads. It does not stop Google's script loading — a certified consent dialog decides that, not this switch (6.9) — and it does not stop that script reading and writing on your device, because a non-personalised ad still does both (7.7). It does not revoke a permission you gave that dialog (6.9.3). It does not delete cookies already on your device (8.5 does that). And because your answer lives in the browser you pressed it in, it does not follow you to another device, and clearing your site data clears it. To go further than non-personalised, block the script (8.6) or clear site data (8.5).

You may also email [email protected] with the word opt out and the email address on your account, and we will record it against your account and confirm it. That gives you something the switch alone cannot: a durable record that follows your account rather than one browser. It is not faster than the switch — nothing is faster than the switch — so if you want the sharing to stop now, press the switch now, and email us afterwards if you want it on file.

12.4. We will not discriminate against you for exercising any of these rights. You will not lose Coins, features, or access, and the price of Coin packs will not change.

13. Changes to this Policy

13.1. We may update this Cookie Policy — for example if we add a feature that stores something new, or if we change advertising partners.

13.2. The current version is always the one published on ganbate.io, dated at the top of this page. If a change is significant, we will tell you in the product before it takes effect.

13.3. If you keep using Ganbate after a change, you accept the updated version.

14. Governing law and contact

14.1. This Cookie Policy is governed by the laws of the State of California, USA. How disputes are resolved — including any agreement to arbitrate, any class-action waiver, and the choice of venue — is governed by the dispute-resolution section of our Terms of Service, not by this document. Nothing here takes away a mandatory consumer right you cannot waive under the law of the country where you live.

14.2. Questions about this Policy, about what we store, or about your choices:

• Email: [email protected]
• Post: Abraham Ahn, 5013 S Louise Ave, Unit #972, Sioux Falls, SD 57108, USA