Cookie Notice
Version 0.1 (draft) · Draft — not yet in effect
Debrief stores information on your device, or reads it from there, only where this is strictly necessary for a service you explicitly asked for: signing in, and remembering choices you make on the site. We use no analytics, advertising, social media or other tracking cookies, and no third-party scripts, fonts or embeds that set cookies. German law allows this without asking for consent (§ 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act, TDDDG, which implements Article 5(3) of the EU ePrivacy Directive), so the site shows no cookie banner. Where the stored information is personal data, the legal basis is GDPR Art. 6(1)(b) (providing the service you use) and, for the choices you make, Art. 6(1)(f).
Cookies
On the secure site the sign-in cookies carry the prefix __Host-, which binds them to this site only.
| Name | Purpose | Lifetime | Set by |
|---|---|---|---|
__Host-apexcoach_session | Keeps you signed in (a random token; the site stores only its hash) | until you sign out, 14 days without use, or 30 days at most | Debrief, when you sign in |
__Host-apexcoach_oauth | Protects a sign-in in progress with your sign-in provider | 10 minutes, deleted when the sign-in finishes | Debrief, when you start signing in |
__Host-apexcoach_access | After a refused sign-in, lets you send an access request as the account you signed in with | 30 minutes | Debrief, on the "No access" page |
__Host-debrief_viewas | Only for the platform admin: while they view the site as a member who asked for help (read-only), names that view | 30 minutes, deleted when they stop viewing or sign out | Debrief, when the platform admin starts it |
__Host-debrief_code | A creator's code from the link you opened (e.g. ?code=FOUNDER-NAME), so the access request form has it filled in after you sign in | 30 days | Debrief, only when you open a link with a valid code |
debrief_org | Remembers which org you chose in the header's org switcher | 400 days, or until you switch again | Debrief, only when you use the org switcher |
All are HttpOnly (not readable by scripts), sent only over HTTPS and only to this site (SameSite=Lax). The names still carry the service's earlier name; they are Debrief's own cookies.
Browser storage
Choices you make on the site are remembered in your browser's local storage on this site, only when you make them. Nothing is sent to us or anyone else.
| Key | What it remembers |
|---|---|
debrief.theme | the dark or light theme you picked |
apexcoach.panel.<kind of page> | whether a side panel is open |
debrief.pref.mapdock, debrief.pref.fightcont, debrief.pref.sqtiles, debrief.pref.flagsrev, debrief.pref.flagspanel | on report pages: the rotation map's position, "Continue playing after fights", how the squad view shows other players' videos, "Show reviewed" flags, whether the flags panel is shown |
sqpanel, debrief.sqdetails | squad view panel layout |
debrief.stats.selection | the players you picked to compare on Player Stats |
debrief.coach.open.<org>, debrief.coach.player.<org> | which parts of the Coach report you had open, and which player |
debrief.coachws | for coaches: which boxes of a student's workspace you had open |
debrief.pref.psopen | on report pages: which Playstyle sections you had open |
debrief.sqnote (session storage, until the tab closes) | a note you are writing in a squad session |
htmx-history-cache, htmx-current-path-for-history (session storage, until the tab closes) | copies of the pages you visited in this tab, so the browser's Back button works |
Report pages downloaded to your own PC (report.html) remember similar choices (theme, captions, speaker names you typed, your right / wrong marks, your fight feedback) in your browser for that file only.
Your choices
You can delete cookies and site data in your browser at any time; you will then be signed out and the site forgets your choices. Blocking the session cookie makes signing in impossible.
Payments
When an org admin buys a plan or credits, or opens the billing portal, they are sent to Stripe's own pages (checkout.stripe.com, billing.stripe.com), which use Stripe's own cookies under Stripe's cookie policy, for example for fraud prevention. Debrief does not load Stripe's scripts on its own pages and does not read Stripe's cookies.
A coach's upload and share links
The pages a coach's student opens (the upload link and the view-only report link) set no cookies; the upload page keeps the progress of an interrupted upload only in the open tab.
Sign-in providers
When you sign in, you are sent to your sign-in provider (Google, Facebook, Discord or Microsoft), which uses its own cookies under its own policy. Debrief does not read them, and the Debrief site loads no script, button or pixel from these providers (the sign-in buttons are plain links).