Cookie Notice · RO. Nation LIVE

01The short version

We set one cookie that keeps you signed in, and a few short-lived ones that only exist for the ten minutes it takes to sign in with Roblox. That is the whole list.

We use no analytics cookies, no advertising cookies, and no third-party trackers. That is why there is no cookie banner: there is nothing here to consent to that the site could work without.

02What a cookie is here

A cookie is a small piece of text your browser stores for a site and sends back on each request. We use them for exactly one job - remembering that you are signed in - and for the handshake that signs you in. Nothing we set watches what you do or follows you anywhere else.

03The session cookie

When you sign in with Roblox, we set a single cookie named ron_session. It holds a signed token identifying your account - your Roblox user ID, username, display name and avatar - and nothing more. It is what lets you move between pages without signing in again.

It is HTTP-only, so scripts running in your browser cannot read it.
It is marked Secure in production, so it is only ever sent over HTTPS.
It uses SameSite=Lax, which keeps it from being sent along with most cross-site requests.
It lasts up to 30 days, or until you sign out - whichever comes first.
It is strictly necessary: without it, there is no way to stay signed in.

04It is scoped to one hostname

The session cookie is tied to the exact host that set it. Signing in on the portal is not signing in on the main site, and signing in on a partner's site is not signing in on ours. That separation is deliberate - each host carries its own login and can see only its own.

05The sign-in cookies

Signing in with Roblox is a redirect out to Roblox and back. To do that safely we set a few short-lived cookies - ron_oauth_state, ron_oauth_verifier, ron_oauth_return and, for a paid checkout, ron_oauth_grant - on our sign-in host.

They carry the security values for the round trip: a random state to prevent request forgery, a PKCE verifier, and where to send you afterwards. They are HTTP-only and Secure, they expire after ten minutes, and once you are back they have done their job. They hold nothing about who you are - they exist only for the handshake.

06What we don't set

To be as specific about the absence as about the presence:

No analytics cookies. We do not measure you across pages or visits.
No advertising cookies, ad pixels, or retargeting tags.
No third-party tracking cookies. Nothing we set is read by a company other than us.
Nothing that is sold or handed to a data broker.

07Cookies set by Roblox and Discord

When you sign in with Roblox, or when staff sign in with Discord, part of that happens on Roblox's and Discord's own websites, which may set their own cookies on their own domains. Those are theirs, not ours, and are governed by their cookie and privacy policies - not by this notice.

08Managing cookies

You can delete cookies or block them in your browser's settings at any time. Because our session cookie is strictly necessary, blocking it means you will not be able to stay signed in - you can still browse the public site, but you will not be able to reach your tickets, the portal, or a survey.

There is no preference to toggle here because there is no optional cookie to toggle. If we ever added one, we would ask first.

09Changes to this notice

If we change the cookies we set, we update this page and the date at the top of it.

10Contact

Questions about this notice? Use the contact page or email hello@ronation.live.