Legal

Cookie Policy.

What sits in your browser. What it does. How to turn it off.

This Cookie Policy explains which cookies Project Real uses on the official Real domains (projectreal.gg, projectreal.live, projectreal.net, realest.gg) and API subdomains such as api.projectreal.gg. It is part of our Privacy.

1. Summary

We currently use essential cookies for login, CSRF protection, cookie preferences, and Cloudflare security. We do not use analytics, advertising, or marketing cookies on the official Real domains as of September 2026. External providers may use their own cookies after you choose to leave Project Real for sign-in or an advertising step.

Legal basis: Where GDPR-style laws apply, cookies and related personal-data processing listed below are used for performance of a contract (account login, license redemption, account management) and for legitimate interests in IT security, fraud prevention, CSRF protection, and abuse prevention. Non-essential cookies require consent before use in regions where that is required.

2. Cookies set by Project Real

Name Domain Purpose Duration Attributes Type
account_session projectreal.gg Keeps you signed in and lets the API verify authenticated account requests. 24 hours standard; 30 days if "Remember me" or Discord sign-in is used HttpOnly Secure SameSite=Lax Essential
account_csrf projectreal.gg Protects account actions against CSRF. Because it uses Domain=projectreal.gg, browser DevTools may show it under both the main site and API subdomain. This is one domain-scoped cookie. Matches the account_session duration JS-readable Secure SameSite=Lax Essential
real_cookie_consent projectreal.gg Stores your cookie preference so the banner does not appear on every visit. 1 year JS-readable Secure SameSite=Lax Essential

3. Third-party cookies

Name Provider Purpose Duration Attributes Type
cf_clearance Cloudflare Shows Cloudflare that your browser passed a security challenge, so the challenge is not repeated on every request. Set by Cloudflare challenge configuration; valid while Cloudflare accepts the clearance. Secure SameSite=None Partitioned Essential
__cf_bm Cloudflare A Cloudflare Bot Management cookie that helps distinguish normal traffic from automated abuse. 30 minutes of inactivity HttpOnly Secure SameSite=None Essential

For Cloudflare's full cookie documentation and data processing practices, see Cloudflare Cookies and the Cloudflare Privacy Policy.

4. Cookie security

HttpOnly: JavaScript cannot read this cookie. Used for account_session.

Secure: The browser only sends this cookie over HTTPS.

SameSite=Lax: Helps block most cross-site request attacks while keeping normal login and navigation flows working.

JS-readable: Our frontend can read this cookie. Used only for the CSRF token fallback and preference storage.

5. Why no opt-in for essential cookies?

In regions with cookie-consent rules, non-essential cookies normally require consent. The cookies listed above are essential because they provide login, account security, preference storage, and bot protection. If we add analytics, advertising, or other non-essential cookies in the future, we will request consent first where required.

6. Managing and deleting cookies

You can view, block, or delete cookies in your browser at any time. Blocking essential cookies will prevent login, dashboard access, and ad-step redemption from working.

  • Chrome / Edge: Settings > Privacy and security > Cookies and other site data > See all site data and permissions
  • Firefox: Settings > Privacy & Security > Cookies and Site Data > Manage Data
  • Safari: Settings > Privacy > Manage Website Data
  • Mobile browsers: Clear browser data or site-specific data in your browser's settings app.

7. Your consent settings

Your current settings

8. External authentication and advertising providers

These services are opened only when you choose Discord sign-in or an external advertising step. Cookies and similar storage on their domains are controlled by those providers, not by Project Real.

Provider Domain Purpose Duration Type
Discord discord.com Authentication and linking a Discord account. Discord may use its own cookies and similar storage after you choose Discord sign-in. Defined by the provider External provider
Work.ink work.ink Completing an optional advertising step for a free key or download. Work.ink and its advertising partners may use their own cookies or similar identifiers. Defined by the provider External provider
LootLabs lootlabs.gg Completing an optional advertising step for a free key or download. LootLabs and its advertising partners may use their own cookies or similar identifiers. Defined by the provider External provider

Red Square protects the LootLabs flow against abuse through server-to-server processing. In the current integration, it does not set a cookie on the Project Real website. A protected link may redirect through a Red Square domain before reaching LootLabs.

Provider privacy information: Discord, Work.ink, LootLabs.

9. Changes to this policy

We update this Cookie Policy when our website, backend, or legal requirements change. Material changes will be announced via our Discord server. The latest version is always at projectreal.gg/cookies.

10. Contact

Cookie and privacy questions: support@projectreal.gg. Full data processing information: Privacy.

Last updated: September 27, 2026.