Cookie Policy · Oskii

The short version

This website sets no cookies. Not one — no analytics, no advertising, no tracking pixel.
You will never see a cookie banner here, because there is nothing to ask you about.
The Oskii product sets two cookies, both to keep someone signed in: one for store staff, one for store owners.
Both are strictly necessary. Blocking them means sign-in stops working; nothing else changes.
We use no third-party cookies at all, so nobody else is following you from here.

This summary is here to be read, not relied on. The numbered sections below are the agreement.

1.The short answer

Most cookie policies are long because most sites set a lot of cookies. This one is short.

The oskii.app website sets no cookies. Every page you can reach here — the home page, the waitlist, this document — is served without a single cookie. There is no analytics tool, no advertising tag and no social media widget embedded in these pages, so there is nothing setting one behind our backs either.

That is also why you have not been shown a cookie banner. A consent banner exists to ask permission for cookies that are not strictly necessary, and we do not set any.

2.What a cookie is

A cookie is a small text file a website asks your browser to keep and hand back on your next visit. It is what lets a site recognise you between one page and the next — which is how staying signed in works.

The distinction that matters is what a cookie is for:

Strictly necessary cookies make a feature you asked for work, such as staying signed in. A site does not need your consent for these, because without them the thing you asked for does not function.
Analytics cookies count visitors and measure what they do.
Advertising cookies build a profile of you across sites to target ads.

Oskii uses the first kind, and only the first kind.

3.Cookies on this website

None. The website at oskii.app sets no cookies of any kind, first-party or third-party.

It also stores nothing in your browser by other means. There is no local storage, no session storage and no fingerprinting script.

Two details that would ordinarily leak a visit to somebody else, and here do not: the brand fonts are served from our own domain rather than a font network, and the images on these pages are our own files rather than embeds. Loading this page tells no third party that you loaded it.

Our host, Vercel, may set a cookie that is strictly necessary to route or protect a request — for example while mitigating an attack. We do not control that, it carries no information about you, and it is not used to build any profile.

4.Cookies in the Oskii product

Inside a game store, Oskii sets two cookies. Both do the same job — keeping somebody signed in — and both are strictly necessary.

Cookie	What it does	Lifetime	Category
__Host-staff_session	Keeps a staff member signed in to the pick list after they enter their PIN, so they sign in about once a shift rather than on every tap. HttpOnly, Secure and SameSite=Lax, so it is unreadable to scripts and is not sent from other sites.	12 hours	Strictly necessary
better-auth.session_token	Keeps a store owner signed in to the admin pages, where inventory imports and staff accounts are managed. Set by our authentication library, better-auth. Over https the browser stores it as __Secure-better-auth.session_token.	Up to 7 days, renewed while in use	Strictly necessary

Neither cookie follows you anywhere. They are readable only by Oskii, only over an encrypted connection, and never by JavaScript running in the page. Signing out deletes the staff cookie on that device immediately.

The customer kiosk

The kiosk is a native iPad app locked to a single screen, not a web browser, so no cookies are involved in searching for cards or submitting a fetch request. Card images load directly from Scryfall’s servers, which means the iPad contacts Scryfall to fetch a picture; we send Scryfall nothing about who is looking, and those requests are not used to set a cookie on the device.

5.What we do not use

To be explicit, because “we value your privacy” is usually where a policy stops being specific:

no Google Analytics, and no analytics product of any other name;
no advertising network, retargeting tag or conversion pixel;
no Facebook, LinkedIn, X or TikTok pixel;
no session-recording or heatmap tool;
no device fingerprinting;
no data broker, and no sale or sharing of anything a cookie could collect.

If we ever add analytics, we will update this page before it goes live, and in places where the law requires consent for it we will ask you first rather than set it and mention it later.

6.Controlling cookies

Your browser can block or delete cookies, usually under Settings, then Privacy. Every major browser publishes instructions, and they change often enough that linking to them here would only rot.

On this website, blocking cookies changes nothing at all, because there is nothing to block. In the product, blocking cookies stops staff and admin sign-in from working: without the session cookie the pick list cannot tell one signed-in device from an unknown one, and it will ask for a PIN on every page.

Do Not Track and Global Privacy Control

We do not track you across sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour those signals by default, in the sense that the behaviour they ask us to stop is behaviour we never started.

7.Changes, and how to reach us

If this changes — most likely because we added a cookie the product needs — we will update the table above and change the “last updated” date at the top of this page. If a change means setting a cookie that is not strictly necessary, we will ask for consent before setting it, not afterwards.

Questions go to hello@oskii.app. This policy sits alongside our Privacy Policy, which covers everything else we do with personal information, and our Terms of Service.

Questions about this document? Email hello@oskii.app. A human reads it.