Cookie Policy
Last Updated: September 5, 2026
This policy explains which cookies and similar technologies DeportID (RAMBIT S.A.S.) uses, for what purpose, for how long, and who can access the information. It complements the Personal Data Processing Policy, which remains the primary privacy document.
1. What cookies are
A cookie is a small file a site stores in your browser. Alongside them we use equivalent technologies — local browser storage, IndexedDB, device identifiers and pixels — which serve the same function and follow the same rules. Where this policy says “cookies”, it means all of them.
2. What we use and why
Necessary
These make the platform work: signing in, keeping you identified, remembering your language, protecting your account and storing your own cookie decision. The service cannot be provided without them, so they cannot be switched off.
No consent required: they are exempt under article 22.2 of the Spanish LSSI-CE as strictly necessary to provide the service you requested.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| keyUserIndex · hashKey | ePayco | Identify your session with the payment gateway while your card is tokenized in your own browser, so the number never passes through DeportID's servers. Loaded only on the payment screen. | Until you clear site data |
| sb-<project>-auth-token | Supabase | Keeps you signed in and refreshes your access credentials. | 1 year |
| deportid_cookie_consent | DeportID | Stores your decision on this policy and its version, so we stop asking. | 12 months |
| deportid_terms_version | DeportID | Remembers which version of the terms you accepted. | 1 year |
| deportid_age_verified | DeportID | Avoids repeating the age check that protects minors on the platform. | 1 year |
| deportid_pending_consent · deportid_sign_in_method · deportid_post_login_redirect · deportid_pending_email | DeportID | Carry from the sign-in form to the session what you accepted, which button you used, where you were going and which email the code went to. Cleared on sign-in. | 10–30 minutes |
| deportid_signup_method | DeportID | Flags for a few minutes that the account was just created, to measure sign-ups. | 10 minutes |
| deportid_access | DeportID | Invite-only access during the closed phase. | 1 year |
| deportid_acting_as | DeportID | Records that a guardian is acting on behalf of a supervised minor account. | Session |
| deportid_consent_region | DeportID | Records whether your country's law requires asking for consent, so the notice is shown only where it is due. | 24 hours |
| NEXT_LOCALE | DeportID | Remembers the language you want the platform in. | 1 year |
Analytics
These tell us which screens get used, where a flow is abandoned and what breaks, always in aggregate. We never sell this information nor use it for behavioural advertising.
These require your consent, which you can withdraw at any time.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| ph_<token>_posthog | PostHog | Anonymous identifier used to measure feature usage and detect application errors. | 12 months |
| __ph_opt_in_out_<token> | PostHog | Records that you declined analytics, so we honour it on every visit. | 12 months |
| Vercel Web Analytics | Vercel | Aggregate audience and performance metrics. Sets no cookies: it derives an ephemeral identifier that is discarded at the end of the day. | No persistent storage |
Notifications
These let us send you alerts about your matches, tournaments and teams. Actually receiving one also requires granting the permission your browser asks for.
These require your consent, which you can withdraw at any time.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| onesignal-* (local storage and IndexedDB) | OneSignal | Identifies your browser so push notifications about your matches and tournaments can be delivered. | Until you revoke the permission or clear the site's data |
3. Managing your preferences
You can change your decision at any time from the “Cookie preferences” button, available in the footer and on this page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand.
You can also delete or block cookies from your browser settings. Note that blocking the necessary ones will prevent you from signing in and using the platform.
4. Third parties and international transfers
PostHog, Vercel and OneSignal act as data processors and may process information outside your country of residence, including the United States. The conditions applicable to these transfers, including the safeguards adopted, are detailed in the Personal Data Processing Policy.
5. Changes to this policy
If we add, remove or change the purpose of any technology, we update this policy and ask for your consent again where the change requires it. In any case, your decision is renewed after twelve months.
6. Contact
For any question about this policy, or to exercise your personal data rights, write to us at: privacidad@deportid.com