Cookie Policy
1. The Short Version
Stupid Forums does not use advertising cookies or third-party analytics cookies. We use two essential first-party cookies to keep you signed in and protect forms from cross-site request forgery, and browser local storage to remember display details, mature-board choices, and your cookie notice choice. Those entries are essential to the features you request, so the notice offers “Essential only” and “Accept”; both choices produce the same functional result today.
2. Cookies vs. Local Storage
A cookie is a small file a website asks your browser to store and return
with requests. Local storage is a browser key-value store that remains on
your device until it expires or is cleared and is not automatically sent
with every HTTP request. The sf_session cookie is
HttpOnly, meaning page scripts cannot read it; the
sf_csrf cookie and a matching token in session storage are
used only to validate state-changing requests. We use local storage for
the non-session entries below. Our hosting and security providers may set
strictly necessary cookies on their own infrastructure.
3. Essential Browser Storage
| Key | Purpose | Typical lifetime |
|---|---|---|
sf_session (cookie, HttpOnly) | Signed-in session token used to authenticate API requests. | Up to 7 days or until logout. |
sf_csrf (cookie) | CSRF token matched against the X-CSRF-Token header for state-changing requests. | Up to 7 days or until logout. |
sf.csrf (sessionStorage) | Page copy of the CSRF token used to fill the request header. It is not an authentication token. | Until the tab closes or logout. |
sf.user | Cached username for the signed-in header. | Until logout or cleared. |
sf.userId | Cached numeric ID used to build your profile link. | Until logout or cleared. |
sf.profileCheckedAt | Timestamp that limits how often the header refreshes profile data. | One minute. |
sf.avatarColor | Fallback avatar color chosen for your profile. | Until changed or cleared. |
sf.avatarUrl | Cached profile image URL for fast header rendering. | Until changed or cleared. |
sf.canModerate | Cached permission hint that shows the Moderation link to staff and moderators. | Until logout or cleared; the server rechecks permission on every request. |
sf.community.v1 | Cached staff-online and trending-thread summary used by the home page. | Up to one minute, until refreshed or cleared. |
sf.mature.accepted.v1 | Your “I Agree” choice for mature and Leaks boards, so the notice is not shown again on that browser. | Until you clear site data. |
sf.cookieConsent.v1 | Your cookie-notice choice and the time you made it, so the notice is not shown on every page. | Until you clear site data or reset the choice below. |
4. What We Do Not Use
- No advertising or retargeting cookies.
- No third-party analytics or session-replay scripts.
- No cross-context behavioral advertising or sale of personal information.
- No fingerprinting for advertising.
5. Third-Party Services
Cloudflare provides hosting, security, and content delivery and may process technical data or set strictly necessary security cookies under its own policies. Pone hosts uploaded images on its own domain and may set its own storage or cookies when you visit it. We do not control third-party storage. Review those providers’ policies before using their services.
6. Your Choices
You can accept or choose essential-only storage in the notice. Because
there are no optional cookies, both choices currently mean the same
thing for site functionality. You can clear these entries at any time
through your browser’s site-data settings. Clearing the
sf_session cookie signs you out; clearing
sf.cookieConsent.v1 makes the notice appear again, and
clearing sf.mature.accepted.v1 makes the mature-board notice
appear again. The button below resets only the notice choice, not your
account or session.
Browser controls vary. In most browsers, open Settings → Privacy and security → Site data, find this site, and delete its storage. Blocking all cookies or local storage may prevent sign-in and preferences from working.
7. Do Not Track and Global Privacy Control
Because we do not sell personal information or use cross-context behavioral advertising, we do not alter our practices in response to browser Do Not Track signals. We honor legally recognized opt-out preference signals, including Global Privacy Control, where required by applicable law. You can also contact Useless@nest.rip to exercise privacy rights.
8. Changes
We may update this policy and the consent key version when our storage practices change. Material changes will be posted here with a new effective date or version and, where required, a fresh choice.
9. U.S. References
- California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., including the CPRA’s treatment of cookies and tracking technologies.
- California Online Privacy Protection Act, Cal. Bus. & Prof. Code §§ 22575–22579.
- Federal Trade Commission Act, 15 U.S.C. § 45 (deceptive or unfair practices).
- FTC, Protecting Personal Information: A Guide for Business, https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business.
- California Attorney General, CCPA resources, https://oag.ca.gov/privacy/ccpa.
- National Conference of State Legislatures, state privacy legislation tracker, https://www.ncsl.org/technology-and-communication/state-action-on-privacy.