Cookie Policy
Last updated: May 6, 2026
This Cookie Policy describes the cookies and similar technologies set when you use GachaBox, the purpose of each, and how to manage your choices. It is a companion to our Privacy Policy.
1. Categories of cookies
We classify cookies into three categories that match the standard PECR / ePrivacy taxonomy:
- Essential. Strictly necessary to deliver the Service you have requested — for example, to authenticate you, to keep you logged in across pages, to process a payment securely, or to remember your consent choices. Essential cookies do not require prior consent under PECR or under most equivalent cookie/ePrivacy regimes, because they are exempt as "strictly necessary" or "solely for the purpose of carrying out the transmission of a communication" / "strictly necessary in order to provide an information-society service explicitly requested by the subscriber or user".
- Analytics. Help us understand how visitors use the Service in aggregate so we can improve it. Analytics cookies require your prior consent. We do not currently set any analytics cookies (see §2).
- Marketing. Used to deliver advertising or to measure ad effectiveness. Marketing cookies require your prior consent. We do not currently set any marketing cookies (see §2).
2. Per-cookie disclosure
The following table lists every cookie set by GachaBox or by an essential third-party processor. Stripe checkout cookies are set on checkout.stripe.com when you are redirected to complete payment; we do not control them, and you can review the full list in Stripe's own cookie disclosure.
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
__session | Clerk | Essential | Authentication session — keeps you signed in. | Session |
__client_uat | Clerk | Essential | Authentication signal — last time the client was authenticated. | 1 year |
| Stripe checkout cookies | Stripe (set on checkout.stripe.com) | Essential | Payment session, fraud screening, and Stripe.js operation while you complete checkout. Set when you are redirected to Stripe's hosted checkout page. | Session |
cookieConsent | GachaBox | Essential | Records your consent choices so the banner is not re-shown on every page load. Stored in localStorage and mirrored to a server-side CookieConsent row for audit purposes. | 1 year |
| Analytics | — | Analytics | None enabled at this time. If we add an analytics provider later, we will update this table and re-prompt for consent before any analytics cookie is set. | — |
| Marketing | — | Marketing | None enabled. | — |
3. How to manage your cookie choices
On your first visit (and on every visit until you choose) we display a cookie banner with two options: Accept all and Essential only. We do not pre-select non-essential categories; you must affirmatively choose to allow them. Refusing non-essential cookies is as easy as accepting them.
You may change your choice at any time by clearing the cookieConsent entry from your browser's localStorage for gachabox.com, or by using your browser's cookie controls (Settings → Privacy → Cookies). Most browsers also let you block all third-party cookies or block cookies from specific sites.
We treat all visitors the same regardless of their country: every visitor sees the banner, and analytics/marketing cookies (if any are added in the future) require affirmative consent for everyone. This satisfies the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive standard, even though we do not actively serve EU visitors. You retain the right to withdraw consent at any time, and withdrawal is as easy as the original opt-in.
4. Changes to this policy
When we add, remove, or change a cookie — or when we add a new third-party processor that sets cookies — we update this table and bump the cookie banner version. A version bump invalidates your prior consent and re-prompts you on your next visit, so that consent always reflects the current cookie set. The current SHA-256 content hash and effective date of this Cookie Policy are exposed in our legal-document registry; substantive changes also trigger a re-prompt at next checkout per our Terms of Service.