Cookie Policy
Last updated September 20, 2026
This page explains which cookies and similar browser storage VinylDuel (operated by Sharon Ben Davar) uses, what each is for, and how to control them. It is part of our Privacy Policy.
The short version
We use only cookies that are strictly necessary for signing in securely, and a little storage on your device so you can resume a ranking. We do not use advertising cookies, tracking cookies or analytics cookies, so there is nothing to opt in or out of, and we do not show a cookie consent banner.
If that ever changes (for example, if we add analytics), we will update this page and ask for your consent first.
Cookies we set
These come from our sign-in system (Auth.js). Some are set as soon as you open the site, even if you never sign in, because the sign-in security check needs them. On secure (https) connections the names begin with a prefix such as __Secure- or __Host-.
| Cookie | What it is for | Lasts |
|---|---|---|
| authjs.session-token | Keeps you signed in. Set only after you sign in. | 30 days |
| authjs.csrf-token | Protects sign-in and sign-out from forged requests (a security check). | Until you close the browser |
| authjs.callback-url | Remembers which page to bring you back to after signing in. | Until you close the browser |
| authjs.state, authjs.nonce, authjs.pkce.code_verifier | Temporary security values used only while you are signing in with Google. | About 15 minutes |
All of these are first-party cookies set by VinylDuel, are marked HttpOnly (page scripts cannot read them), and are never used to track you or to show advertising.
Storage on your device (not cookies)
Your browser or app also keeps a few items in local storage. They never leave your device unless you finish a ranking while signed in.
| Item | What it is for | Lasts |
|---|---|---|
| vinylduel_in_progress_tournament | Your unfinished ranking, so you can resume it. | Until you finish, discard it or delete your data |
| vinylduel_pending_rankings | A ranking you finished while signed out or offline, kept until you sign in and it can be sent. | Until it is sent or you delete your data |
Other companies
When you choose "Sign in with Google", you are sent to Google, which sets its own cookies on its own website under Google's policies. We do not control them.
Album, song and preview information is requested from Apple by your browser directly. We do not add cookies for that, but as with any website you visit, Apple receives your IP address (see our Privacy Policy).
Your choices
- You can block or delete cookies in your browser settings. Browsing, ranking and viewing shared pages will still work, but you will not be able to sign in.
- Signing out removes the session cookie.
- On the Account page you can erase the local storage items above together with your saved rankings.
Changes
If we change the cookies we use, we will update this page and the date at the top.
Questions? Write to sharon.bendavar@gmail.com. You can also manage your data yourself on the Account page.