Essential account session
cup_session is a first-party CUPSOCCER cookie that connects the browser to its server session. It is HttpOnly and SameSite=Lax, and Secure when accessed over HTTPS. A guest session lasts up to two hours; a registered session lasts up to 30 days unless you sign out or start a break.
The server stores only a hash of the random session identifier. The cookie is necessary for account access, balances and protected play, and is removed on sign-out.
Form-request security
cup_csrf is a first-party security cookie used to verify requests from the club’s own forms. It is HttpOnly, SameSite=Strict, Secure over HTTPS and lasts up to 24 hours.
Its token is compared with the request sent by the page. This protects account and support actions against forged cross-site submissions. It is essential and does not track activity across websites.
Game recovery and reminders
The game uses first-party session storage named cup:round:{account}:{game}, with a :choice suffix when needed, to remember an interrupted request identifier. These entries are cleared after the round or choice settles and expire when the browser tab session ends. The server, rather than these entries, determines every result and balance.
cup:reminder:{visit-start} remembers a dismissed session reminder until the tab session ends. Sound, play-speed, shirt and lineup preferences are saved with your account. These functional settings do not track you across websites.
Google Analytics runs automatically
Google Analytics loads automatically on website visits. Advertising storage, ad user data and ad personalization remain denied.
Google may set _ga and _ga_<measurement suffix> automatically to recognize visits, limited to 90 days. Essential sign-in and security cookies remain separate. An earlier cup_preferences acknowledgement or analytics choice does not control analytics activation.
Storage Choices describes the active categories. Your browser can display and remove website cookies. Manual page views use paths without URL queries or fragments. We do not enable marketing cookies.
Browser controls
You can delete or block cookies through your browser. Removing the session cookie signs you out; blocking essential cookies prevents account, guest and protected-game functions from working correctly.
Browser controls do not delete an account or shorten an account break. Use the help desk for personal-data requests. Policy updated 6 October 2026.
Review your storage choices