PageLab sets one cookie. It keeps you signed in on the web, and that is all it does. There is no analytics cookie, and nothing we set follows you to another site, so there is nothing on this page to opt out of. This page describes what PageLab sets today; if that changes, this page changes with it.
The one cookie
| Name | What it does | How long it lasts |
|---|---|---|
pl_session |
Keeps you signed in on the website. It is set when you sign in, register, sign in with Google, or complete a password reset, and it is cleared when you sign out. | 30 days, or until you sign out |
It is marked HttpOnly, so no script on the page can read it — that is the reason we use a cookie for this rather than storing the credential somewhere JavaScript can reach. It is marked SameSite=Lax, so another site cannot cause your browser to send it, and Secure on our live sites, so it only travels over an encrypted connection.
Two things worth being straight about. The cookie contains your sign-in credential itself rather than a reference number we look up — there is no separate session table on our side. And that credential lasts 30 days: signing out clears the cookie in that browser, but we cannot reach into a browser we have never seen to expire one early. If you are on a shared or public computer, signing out is what protects you.
What we do not set
- No analytics. There is no Google Analytics, Plausible, Fathom, Segment or equivalent anywhere on the site. We do not measure your visit.
- No tracking cookies. Nothing we set follows you from PageLab to another site.
- No consent banner, because a banner exists to collect consent for the cookies above, and we do not set any of them today.
The one script we load from someone else
The sign-in and sign-up pages load Google’s sign-in script from Google, so that the Continue with Google button works. It is the only thing on this site loaded from another company and it is on no other page. We use it to draw that button and nothing else — Google’s One Tap prompt is not enabled — so PageLab still sets only the one cookie described above. What Google receives when you use the button is set out in the Privacy Policy.
Other things stored in your browser
These are not cookies — they stay on your device and are never sent to us automatically — but you would reasonably want them listed.
pagelab.theme— your appearance choice: light or dark, the accent theme, and any custom tint. Kept locally so the page paints in the right colours before it has finished loading; your account's real setting lives on our server.pagelab.reader— your reading preferences: tint, font and text size.pagelab_install_id— a random identifier generated by your browser, not by us, and not linked to your name. It exists so that an age answer given during signup applies to the browser that gave it. It is not used to recognise you across sites and it is not shared.pagelab_age_answered_at— the time you answered the age question at signup, so you are not asked again on every visit.
Clearing your browser's site data removes all four, along with the cookie. Nothing breaks permanently: you will be signed out, and your appearance and reading preferences fall back to the ones stored on your account.
The app is different
The Android app does not use cookies at all. It keeps your sign-in token in the app's own private storage, which no other app on your device can read. Clearing that is what signing out of the app does.
Where to ask
Questions about this page go to support@orbytgames.com. What we collect on the server side — as opposed to what sits in your browser — is set out in the Privacy Policy.