Cookie Policy

1. What Are Cookies

Cookies are small text files that are stored on your computer, tablet, or mobile device when you visit a website. They are widely used by websites to make them function properly, to improve efficiency, and to provide information to the site owners.

When we refer to "cookies" in this policy, we include cookies and similar technologies such as localStorage and sessionStorage, which serve comparable purposes in your browser. These technologies allow websites to store small amounts of data locally on your device to remember information between page visits and browsing sessions.

Cookies set by the website you are visiting are called "first-party cookies." Cookies set by parties other than the website owner are called "third-party cookies." Third-party cookies enable features or functionality to be provided on or through the website, such as authentication via external providers.

2. How FrostWeb Uses Cookies

FrostWeb Studios uses cookies for one purpose: to sign you in and keep your account safe. Every cookie we set is strictly necessary. We do not set functional, analytics, or advertising cookies on any FrostWeb website, and we do not track you across other sites.

Strictly Necessary Cookies

These cookies are set by the account service on the .frostweb.studio domain so that one sign-in works across all FrostWeb websites. Without them, signing in and staying signed in would not be possible. They are used for:

• Your signed-in session — The accessToken cookie proves who you are on each request, and the refreshToken cookie renews that session so you do not have to sign in again every few hours. Both are HttpOnly and Secure, so scripts on the page cannot read them and they are only sent over HTTPS.
• Cross-site request forgery protection — The __Host-csrf (or csrf) cookie implements a double-submit pattern that makes sure requests to our servers genuinely come from you and not from another site you have open.
• Two-factor sign-in — When your account has two-factor authentication enabled, a short-lived mfaPendingToken cookie holds your sign-in for the few minutes it takes to enter your authenticator code.
• Signing up or signing in with another service — The pendingSSOToken cookie carries a Google, Steam, or Epic Games sign-up through to the point where you finish creating your FrostWeb account, and the steam_auth_state cookie protects the round trip to Steam and back.

None of these cookies record what you do on our websites, which pages you visit, or anything about you beyond what is needed to recognise your session.

3. Specific Cookies We Use

The following table lists every cookie set by FrostWeb Studios. All of them are set by the account service on the .frostweb.studio domain:

All cookies listed above are classified as strictly necessary and are required for the proper functioning and security of our services. This is the complete list; no other cookies are set by FrostWeb websites.

4. Third-Party Cookies

Certain features of our services take you to a third-party provider's own pages. Those providers may set their own cookies on their own domains while you are there:

• Google — When you choose to sign in or register using Google, Google may set cookies as part of the authentication flow. These cookies are governed by Google's Privacy Policy.
• Steam — When you sign in with or link your Steam account via OpenID authentication, Valve may set cookies during the login and verification process. These cookies are governed by Steam's Privacy Policy.
• Epic Games — When you sign in with or link your Epic Games account, Epic Games may set cookies as part of the authentication flow. These cookies are governed by Epic Games' Privacy Policy.
• Stripe — When you pay through Stripe, the checkout pages are Stripe's and Stripe sets its own cookies there. These are governed by Stripe's Privacy Policy and Cookie Policy.
• PayPal — When you pay through PayPal, the checkout pages are PayPal's and PayPal sets its own cookies there. These are governed by PayPal's Privacy Statement and Cookie Statement.
• Google Fonts — The marketing site at frostweb.studio loads its fonts from Google Fonts. Google Fonts sets no cookies, but Google sees your IP address when the fonts load. This is subject to Google's Privacy Policy. The account hub serves its own fonts and does not contact Google.

FrostWeb Studios does not use any advertising or tracking cookies from third parties. We do not sell your data, and we do not allow third-party advertisers to place cookies on our websites.

5. Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically find cookie management options in your browser's "Settings," "Preferences," or "Privacy" menu. Here is how to manage cookies in popular browsers:

• Google Chrome — Settings → Privacy and Security → Cookies and other site data. You can block or allow cookies for specific sites, clear existing cookies, or block all third-party cookies. Visit Chrome's cookie documentation for detailed instructions.
• Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data. Firefox offers Enhanced Tracking Protection with Standard, Strict, and Custom modes. Visit Firefox's cookie documentation for detailed instructions.
• Safari — Preferences → Privacy → Manage Website Data. Safari blocks cross-site tracking by default and provides options to block all cookies. Visit Safari's cookie documentation for detailed instructions.
• Microsoft Edge — Settings → Cookies and site permissions → Manage and delete cookies and site data. Edge offers Basic, Balanced, and Strict tracking prevention levels. Visit Edge's cookie documentation for detailed instructions.

Important: Clearing cookies for frostweb.studio signs you out of every FrostWeb website, because the accessToken and refreshToken cookies are what keep you signed in. If you block cookies for our domain entirely, you will not be able to sign in until you allow them again.

The first time you visit the account hub at accounts.frostweb.studio, a one-time notice explains that we use only strictly necessary cookies: your session, a security token, and short-lived sign-in state. There is no consent choice to make, because we set no advertising or analytics cookies and there is nothing to opt out of. Dismissing the notice records that in your browser (see Section 6) so it is not shown again.

6. Local Storage & Session Storage

In addition to cookies, the account hub uses your browser's local storage for a single entry, stored on your device under accounts.frostweb.studio:

• fw.cookieNotice.v1 — Remembers that you have dismissed the cookie notice described in Section 5, so it is not shown on every visit. It contains no information about you.

Session tokens and CSRF tokens are kept in the cookies listed in Section 3, not in local or session storage.

You can clear local storage through your browser's site settings. In most browsers, navigate to your browser settings, find the site data for accounts.frostweb.studio, and select the option to clear storage. Alternatively, you can access Developer Tools (typically F12), navigate to the Application or Storage tab, and remove the entry. The cookie notice will simply be shown once more on your next visit.

7. Changes to This Policy

FrostWeb Studios may update this Cookie Policy from time to time to reflect changes in our cookie practices, new technologies, or for other operational, legal, or regulatory reasons. Any changes will become effective when the updated policy is posted on this page, and we will update the "Effective Date" at the top of this policy accordingly.

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies and related technologies.