XPULZ Cookie Policy
Effective date: 6 October 2026
In short
- A few cookies are necessary: they keep you logged in and remember your choices.
- Audience measurement (Google Analytics) runs only if you accept it. It is off by default. We use no advertising tracker and no session recording.
- Saying no costs you nothing: your account and your tournaments work the same.
- You can change your mind at any time with Cookie settings in the footer.
1 About this policy
XPULZ Gaming GmbH, Fällandenstrasse 3c, 8124 Maur, Switzerland, uses cookies and similar technologies on xpulz.com and on the services it operates that link to this policy. Contact: info@xpulz.com.
Our Privacy Policy explains what personal data is involved, who receives it, where it goes, how long it is kept and what your rights are.
On a tournament platform run under a brand's name, that platform's own notice lists the technologies it uses and which company decided to use them. XPULZ's own analytics never loads there. If the organizer sets its own Google Analytics, the notice names the organizer and asks before anything loads; neither the brand nor the company running its tournaments can add tracking that bypasses your choices.
2 What these technologies are
A cookie is a small file a site stores in your browser. Local storage, pixels and software kits do similar jobs: recognize a browser, keep a login, remember a choice or measure what happens on a page. Some last for one visit, others for a set time. What matters for your consent is what a technology does, not what it is called or who sets it.
3 Your choices
Everywhere in the world, we ask before switching on anything optional, even where the local law would not require it.
The first time you visit, the notice offers Accept and Refuse, side by side and with the same look. Analytics stays off until you choose. Browsing on, creating an account or accepting the Terms is not a consent.
You can change or withdraw your choice at any time with Cookie settings in the site footer, or the same control in the app. When you withdraw, we stop the collection and remove or disable the identifiers we control. What was already collected is handled as the Privacy Policy says.
Your choice applies to the browser and the site where you make it, and lasts 6 months; we then ask again. It does not follow your account: another domain, another browser or cleared storage means we ask again.
We ask again before any new optional purpose, and keep only the record needed to prove and respect your choice.
4 Categories
| Category | What it is for | Your choice |
|---|---|---|
| Necessary | What a function you ask for cannot work without: secure login, protection against forged requests, a payment you start, remembering your cookie choice. Useful to us is not the same as necessary. | Always on. |
| Analytics | Understanding how the site is used, to improve it. | Off until you accept. |
| External content | Loading a video, a form or another feature from a third party. | Loaded only when you ask for it. |
A tool that serves two purposes needs both permissions: accepting analytics never switches on advertising.
5 What we use
Lifetime is how long an identifier stays on your device. How long the data is kept on servers is in the Privacy Policy.
Necessary
| Technology | What it does | Where and how long |
|---|---|---|
Login state (auth, browser storage) | Keeps you signed in. | xpulz.com, until you log out. |
Session cookie (dev_xpulz) | Carries the sign-in with Discord, Steam and other linked services. | Our API domain, about 30 days. |
dev_xpulz_api_token | Keeps you signed in when the site calls our API. | Our API domain, 30 days, not readable by scripts. |
social_state | Protects the linking of a third-party account against forged requests. | Our API domain, 10 minutes. |
cookie_xpulz | Remembers your cookie choice, its date and the version of this policy. | xpulz.com, 6 months. |
xpulz_external_content | Remembers the providers whose content you chose to always load ("Always load" under a video). | xpulz.com, browser storage, until you clear it. |
xpulz_locale and translation cache | Remembers your language. | xpulz.com, browser storage, until you clear it. |
Stripe (__stripe_mid, __stripe_sid) | Fraud prevention during a payment. Loaded only when you open a payment form. | stripe.com, 1 year and 30 minutes. |
Optional, off until you accept
| Provider | Category and purpose | Identifiers and lifetime |
|---|---|---|
| Google Analytics 4 | Analytics: pages viewed and navigation. Google Signals and ad personalization are switched off: nothing is used for advertising. | _ga and _ga_GJKRH2LLLN, 2 years (some browsers shorten this). Deleted when you withdraw your consent. |
6 Recordings, external content and emails
External content. Player avatars and game artwork are loaded from the publishers' servers (Steam, Riot Games). Those servers receive your IP address when your browser fetches an image; they set no cookie. A video or a form from a third party is replaced by a placeholder that tells you who provides it, until you choose to load it.
Emails. We measure whether a marketing email was opened or clicked only if the subscription notice says so and you agreed. Subscribing to emails is not a consent to analytics on the site, and the reverse is true too.
Diagnostics. We keep minimal security and error logs, as the Privacy Policy describes. Measuring behavior does not become "necessary" because it runs on our own servers.
AI coaching uses no cookie. What is sent to our AI provider is described in the Privacy Policy. Accepting cookies never allows model training or marketing.
7 Providers and brands
The providers above, the countries where they work and the safeguards that apply are listed in section 9 of the Privacy Policy. A provider can receive data outside Switzerland even though our servers are there.
On a platform run under a brand's name, any company that decides on tracking must be named in that platform's notice, and its tools go through the same consent controls and the same protections for minors. Not offering marketing emails does not allow advertising trackers, and the reverse: each needs its own choice.
8 Browser controls and changes
Your browser lets you view, block or delete cookies and site storage. Blocking the necessary ones can break login or payment; rejecting optional ones through our controls never does. Deleting cookies in your browser does not tell us to delete data already on our servers, nor does it unsubscribe you from emails.
You never need to visit each provider to refuse tracking we would switch on: Cookie settings is enough. If it does not work or your choice is not respected, write to info@xpulz.com.
We update this policy and its lists when the technologies or their purposes change, and ask again before any new optional use.