Cookie Policy
Cookies are small pieces of text a website stores in your browser so it can recognise you between page loads and between visits. Cryptogram Online uses very few of them, and this page lists every one.
The cookies we use
| Cookie | Set by | Category | Lifetime | Purpose |
|---|---|---|---|---|
session_token | This site | Strictly necessary | 30 days | Keeps you signed in and ties your puzzle progress to your browser. |
cookie_consent | This site | Strictly necessary | 12 months | Remembers the cookie choices you made, so you are not asked on every visit. |
cf_clearance | Cloudflare | Strictly necessary | Up to 1 year | Cloudflare bot protection: records that this browser already passed a security check, so it is not challenged again on every page. |
g_state | Strictly necessary | Up to 1 year | Google Sign-In: remembers that you dismissed the Google sign-in prompt, so it is not offered again straight away. | |
_ga | Analytics | 2 years | Google Analytics: distinguishes one visitor from another. | |
_ga_* | Analytics | 2 years | Google Analytics: keeps session state for this site’s measurement stream. |
The categories
Strictly necessary cookies make the site work, and are always on because it does not function without them. Two are ours: one keeps you signed in, and one remembers the cookie choices you made so we do not ask again on every visit. Two come from services the site depends on — Cloudflare records that your browser has already passed its security check, and Google remembers that you dismissed its sign-in prompt. None of them is used for tracking.
Analytics cookies belong to Google Analytics and help us understand which puzzles and pages people use, in aggregate. They are off until you switch them on.
Functional cookies would remember preferences that go beyond what the site needs to work. We do not currently use any; the category exists so that a future feature has to ask before it starts.
Marketing cookies would be used for advertising. We do not currently use any, and we do not show ads.
Google Analytics before you decide
We want to be precise about one thing. The Google Analytics script itself loads for every visitor, but it starts with every permission denied. Until you consent to analytics cookies it sets no cookies, stores nothing in your browser, and sends Google only cookieless pings that carry no identifier tying your visits together — Google calls this arrangement Consent Mode. Only after you switch analytics on does it begin using the _ga cookies listed above.
When Google processes analytics data on our behalf it does so under the Google Ads Data Processing Terms.
Changing your mind
Use the Cookie settings link in the footer of any page to review or change your choices at any time. Withdrawing analytics consent takes effect immediately: the Google Analytics cookies are removed from your browser and no further consented data is sent.
Your choice stands for twelve months, after which we ask again. We will also ask again sooner if this policy changes in a way that matters — a new category, a new third party, or a materially different purpose.
More detail
How we handle personal data more broadly — accounts, puzzle progress, and your rights — is covered by the privacy policy. Questions are welcome through the contact page.