Cookie and Tracking Information

SimulatedCyber uses localStorage and IndexedDB for cached account profiles, completed practice, browser-only unfinished shifts and drafts, preferences, and recovery copies. The account interface separates students’ caches, but someone who controls the device can inspect browser storage. These technologies are not used to follow you across unrelated websites.

The site may ask the browser to preserve local storage for recovery. You can clear the site’s data through your browser. This does not delete your server account or shared team results.

Browser storage also holds non-secret account markers. Passwords, verification codes, Google tokens, and authentication-session tokens are not persisted in localStorage. Browser markers never authorize an account or room action; the server checks the signed-in identity and room membership.

Sign-in sets an essential authentication-session cookie. In production it is Secure, HttpOnly, and SameSite=Strict, and lasts up to seven days unless ended sooner. Application JavaScript cannot read it. It is not an advertising cookie.

Email verification uses an essential ten-minute Secure, HttpOnly, SameSite=Strict browser-flow cookie. Google sign-in uses a ten-minute Secure, HttpOnly, SameSite=Lax flow cookie so its top-level callback can complete. These cookies bind the sign-in request to the same browser. Google and Resend process their own service information under their privacy policies.

Cloudflare may also set cookies that are strictly necessary to deliver, protect, or manage traffic to the production site when a security feature or challenge requires them. Their presence can vary by request and browser.

The production site uses Cloudflare Web Analytics and performance measurement. Cloudflare automatically provides a small browser beacon that reports page views, route changes, and website performance measurements. Cloudflare states that this beacon does not use cookies and does not read localStorage, sessionStorage, or IndexedDB.

The resulting aggregate information helps SimulatedCyber understand site availability and performance. It is not used for advertising or to build a behavioral profile across unrelated websites.

The current public application does not use advertising trackers, marketing pixels, payment trackers, or a remote profile analytics SDK. It therefore does not display a consent banner for nonessential advertising cookies. If nonessential tracking is introduced, this notice and any legally required choices will be updated before that technology is activated.

You can change Settings, sign out, delete your account, clear stored site data, and control cookies through your browser. Clearing local storage does not delete the server account or shared team results. Blocking necessary storage can prevent sign-in, practice saving, or Multiplayer from working.