Cookies
A complete list of what we store on your device. It's short, and that's the point.
1. Everything we store
Cookies you can't turn off
Without these, signing in and staying signed in doesn't work.
- bk_session — your backer sign-in. Holds a random token and nothing else: no name, no email, no card data. Set to HttpOnly and Secure so scripts can't read it. Expires after 30 days, extended while you keep using the site. Deleted when you sign out.
- Clerk sign-in cookies — if you have a creator or admin account, our authentication provider Clerk sets its own session cookies. These do the same job for that side of the product. Clerk is listed on our sub-processor list.
- sfp_view_as_tenant — only ever set for our own staff accounts, so we can view the product the way a creator sees it. Backers never receive this.
Preferences stored in your browser
These aren't cookies — they live in your browser's local storage and are never sent to our servers. They exist so the site doesn't nag you about the same thing twice.
- sfp-arrival-seen and sfp-arrival-dismissed — remember that you've already seen, or dismissed, the welcome message on your pledge page.
Clearing your browser data removes them and costs you nothing except seeing that welcome message again.
2. What we deliberately don't use
- Google Analytics, or any other analytics product
- Meta, TikTok, Google Ads or any other advertising pixel
- Session recording or heatmap tools
- Third-party chat widgets
- Social media embeds that phone home
- Any cookie that exists to build a profile of you
This is enforced in code, not just policy: the site sends a Content Security Policy that blocks scripts from domains we haven't explicitly allowed, so a third-party tracker can't be added by accident.
3. Payment pages
Card payments happen on Stripe's own checkout page, and Stripe sets cookies there to detect fraud and keep your payment session alive. We never see your card number. Stripe's use of cookies is covered by Stripe's privacy policy.
4. Your control
You can block or delete cookies in your browser settings at any time. Blocking the session cookie will sign you out and stop you reaching your pledge, which is the only thing that breaks.
We honour Global Privacy Control and browser Do Not Track signals — though since we don't track or sell anything, there's nothing for them to switch off.
5. If this changes
If we ever add analytics, we'll update this page, change the date at the top, and ask for consent first — properly, with reject as easy as accept. We won't quietly start tracking you.
6. Contact
Questions about anything on this page: james@storyforgerpg.com. See also our Privacy Policy.