PRIVACY / DRAFT

Cookies & device storage.

Current technical audit and consent plan for a future public version, reviewed 12 November 2026.

This describes the reviewed project and one public homepage response only. Recheck all routes, response headers, browser storage and third-party resources after every hosting or monetization change.

Current state

The project source contains no analytics, advertising or social-media embed scripts, and no code that reads or writes cookies. The color-theme switch is held only in page memory and does not save a browser preference. The public homepage response checked for this audit did not send a Set-Cookie header. No cookie-consent banner is currently implemented.

Skin images are requested directly from Steam community CDN hostnames, and video preview images from YouTube’s image host (i.ytimg.com). No YouTube player is embedded. Those image requests expose normal network data to the services involved in delivery. Recheck whether those services set or read device information in the final browser and hosting configuration.

Consent before future integrations

Under § 165(3) TKG 2021, consent is generally required before storing information on or accessing information from a user’s device, except where the operation is strictly necessary to provide a service the user explicitly requested. This covers more than conventional HTTP cookies. Before enabling analytics, personalized advertising, tracking pixels, non-essential local storage or similar integrations, block them until a valid consent is recorded and provide a clear withdrawal route.

The Austrian Data Protection Authority says a consent banner is not required when a site uses no technically non-essential cookies. If consent becomes necessary, refusal must be as easy as acceptance, choices must not be preselected, and consent must be obtained before the relevant technology runs.

Review sources

Austrian Data Protection Authority: privacy and cookies FAQ · Austrian TKG 2021, § 165 · Privacy policy draft.