Cookies Policy

Last updated 8 September 2026.

The short version

xyphros.net only sets cookies that are strictly necessary to make the site work: keeping you signed in, and protecting forms from cross-site attacks. We don't use analytics, advertising, or tracking cookies, so there's nothing here that needs your opt-in consent under EU/UK cookie law. But we're listing every one anyway, because you should be able to see exactly what's set.

Cookies we set

• xyphros_session: keeps you signed in, shared across xyphros.net and portal.xyphros.net so one account works on both. Expires when your session ends or you sign out.
• xs_csrf: a random token used to confirm form submissions (like the contact form) actually came from this site, not a forged request from elsewhere.
• xs_discord_state and xs_discord_return: set only while you're in the middle of linking your Discord account, to confirm the login came back from the right place and return you to where you started. Both expire within minutes and aren't set otherwise.

What we don't set

No analytics cookies (Google Analytics or similar), no advertising or retargeting cookies, and no third-party tracking pixels.

Third-party requests that aren't cookies

A couple of things load from third-party domains as part of normal page rendering, which is worth being upfront about even though they're not cookies we set:

• Google Fonts: the site's typefaces load from Google's font CDN, which sees the requesting IP address like any web request.
• Tebex checkout: when you buy something, you're taken to Tebex's own checkout, which is a separate site with its own cookies outside our control.

Managing cookies

Since everything here is required for the site to log you in and protect forms, turning cookies off in your browser will effectively sign you out and may break account-only pages. You're of course free to do that in your browser's settings at any time.

Questions

Email hello@xyphros.net if anything here isn't clear.