Last updated: [[LAST_UPDATED]]. This policy explains what cookies and
similar technologies Old District (olddistrict.com, operated by
[[OPERATOR_NAME]], “we”, “us”) places on your device
when you use the game, exactly what each one contains, how long it lasts, and where the related data is stored.
It should be read together with our Privacy Policy and Terms of Service.
A cookie is a small text file that a website asks your browser to store on your device (computer, phone or tablet). On your next request the browser sends the cookie back, which lets the site recognise your browser — for example to keep you logged in as you move between pages. Cookies cannot run programs, read other files on your device, or carry viruses.
Cookies are described by a few properties that we reference in the tables below:
olddistrict.com itself; a third-party cookie is set by another domain (for example a payment provider) whose content is loaded on the page.HttpOnly (not readable by JavaScript), Secure (only sent over HTTPS) and SameSite (restricts cross-site sending). All cookies we set use HttpOnly, Secure and SameSite=Lax.
“Similar technologies” such as browser localStorage/sessionStorage can serve
comparable purposes. Old District relies on cookies for the functions described here and does not use these
storage mechanisms to identify or track you.
We use cookies only for two purposes, both of which are needed for the game to work and to keep your account secure:
We do not use analytics, advertising, profiling or social-media tracking cookies of any kind (see section 6).
The following first-party cookies are set on the .olddistrict.com domain, with path /,
and with the Secure, HttpOnly and SameSite=Lax flags.
| Cookie | Category | What it contains | Lifetime / retention | Where stored |
|---|---|---|---|---|
PHPSESSID |
Strictly necessary | A random session identifier. It contains no personal data itself — it is only a key that points to your session record held on our server (your logged-in username and player ID, your IP for the session, the CSRF token, last-activity time, language and onboarding flags). | Session cookie (lifetime 0): removed when you close the browser. The
matching server-side session data is discarded by PHP session garbage collection after a period of
inactivity and is cleared immediately when you log out. |
Cookie: on your device. Session contents: on our server. |
od_remember |
Functional (“Remember me”) | Two random values in the form selector:validator. It stores no username or password.
The selector locates a token row in our database; the validator is checked against a hashed copy.
The token is single-use: each time it is accepted it is rotated (invalidated and
reissued). |
Persistent: 30 days from the last time it was issued. Set only if you tick “Remember me” at login. Deleted on logout, and the server-side token is also deleted when it expires. | Cookie: on your device. Matching token (selector + hashed validator + hashed user-agent + expiry): in our database. |
login, validate |
Legacy (cleared, not set) | Names from an older login scheme. The current site does not create these; it only actively deletes them for safety if an old browser still carries them. | Expired/cleared on logout and on session cleanup. | On your device only, until cleared. |
Note on CSRF protection. Our anti-CSRF token is not a separate cookie — it is stored
inside your server-side session and is reached through the PHPSESSID cookie above.
Because PHPSESSID is only a pointer, here is what the session record it points to may contain while
you are signed in. This data lives on our server, not in the cookie:
This record is deleted when you log out or when the session expires through inactivity.
Some pages load resources from third parties. We do not control the cookies those providers may set, and their own policies apply. Loading their content also reveals your IP address to them by the nature of how the web works.
cdn.tailwindcss.com) — styling framework.cdnjs.cloudflare.com) — Font Awesome icons.
Cloudflare may set a bot-management cookie such as __cf_bm.cdn.jsdelivr.net) — the Toastify notification library.fonts.googleapis.com, fonts.gstatic.com) —
our typefaces and Material Symbols. Google states its font files do not set cookies, but the request
exposes your IP to Google.These are used for appearance and delivery only; they are not used by us to track you. Where a provider is capable of setting a cookie, it is generally strictly necessary/security in nature rather than advertising.
If — and only if — you choose to buy premium credits, you are taken to PayPal
(paypal.com) to complete payment. PayPal sets its own cookies on its own domain for fraud
prevention, security and to process the transaction. We never see your card details. PayPal’s use of
cookies is governed by PayPal’s own cookie and privacy notices.
To be explicit, Old District does not use:
The following are not cookies — they are records kept on our server — but we list them here for full transparency about what we collect and for how long, as they are tied to the same login and security functions.
| Record | What we store | Why | Retention |
|---|---|---|---|
| Remember-me tokens | Random selector, a hashed validator, a hashed user-agent, and an expiry date — linked to your player ID. No password. | To let you stay signed in securely and to detect misuse of a stolen cookie. | Deleted at expiry (max 30 days) or on logout; expired rows are purged automatically. |
| Login throttling | IP address, the username attempted, a failure counter and a “blocked-until” time. | To slow down brute-force and credential-stuffing attacks (a legitimate security interest). | Short-lived; cleared on a successful login and as blocks expire. |
| Security request log (“omnilog”) | For certain POST requests: time, username (if any), IP, any forwarded-for header, the script hit and the submitted form/query data. | Abuse investigation, fraud prevention and debugging. | [[OMNILOG_RETENTION]] — define and enforce a fixed period (e.g. 90 days) and delete older entries. |
You can view, block or delete cookies through your browser settings. Helpful pages are provided by Chrome, Firefox, Safari and Edge.
Please note: if you block the strictly necessary cookie (PHPSESSID), you will not
be able to log in or stay logged in, and secured actions will fail. Blocking or clearing od_remember
simply means you will be asked to sign in again.
We may update this policy as the game evolves. Any material changes will be reflected by a new “Last updated” date at the top. If you have questions about cookies or your data, please contact us at [email protected].