The short version
- This website sets no cookies. Not one — not for advertising, not for sign-in, not even for the page views we count.
- You will never see a cookie banner here, because there is nothing to ask you about.
- We do count page views, with Vercel Web Analytics. It is cookieless: it stores nothing in your browser and gives you no identifier, so it sets nothing a banner would have to ask about.
- The Oskii product sets two cookies, both to keep someone signed in: one for store staff, one for store owners.
- Both are strictly necessary. Blocking them means sign-in stops working; nothing else changes.
- We use no third-party cookies at all, so nobody else is following you from here.
This summary is here to be read, not relied on. The numbered sections below are the agreement.
1.The short answer
Most cookie policies are long because most sites set a lot of cookies. This one is short.
The oskii.app website sets no cookies. Every page you can reach here — the home page, the waitlist, this document — is served without a single cookie. There is no advertising tag and no social media widget embedded in these pages, so there is nothing setting one behind our backs either.
One thing does measure you, and we would rather name it in the first paragraph than bury it: we count page views, using Vercel Web Analytics. It is worth saying plainly that it does this without a cookie and without storing anything in your browser, because most analytics cannot say that, and a reader is entitled to assume the worst until told otherwise. Section 3 sets out exactly what it sends.
That is also why you have not been shown a cookie banner. A consent banner exists to ask permission for cookies that are not strictly necessary, and we do not set any — not because the counting was hidden from the banner, but because the counting does not need one.
3.Cookies on this website
None. The website at oskii.app sets no cookies of any kind, first-party or third-party.
Nothing here writes to your browser by other means either — not local storage, not session storage, not a database in the browser — and there is no fingerprinting script. Close the tab and your browser has kept nothing from the visit.
The one thing we do count
We count page views with Vercel Web Analytics. The script is served from oskii.app and sends what it measures back to oskii.app, rather than to an address belonging to somebody else. Each view sends the address of the page including anything after the question mark, the site you came from if you came from another site, the time, and the version of the script. There is no cookie in it, no stored value and no number that identifies you. Vercel then works out an approximate location, browser, operating system and device type from the request itself; their documentation’s example of that precision is “US, California, San Francisco”.
Vercel host this site, so they already see the request. What is new is that they now also receive it as our analytics provider, which is a different job from hosting and is listed as one in the Privacy Policy’s provider table. If you would rather not be counted, a content blocker will stop it, and there is nothing left on your device to clear afterwards because nothing was put there. You can also email us to object.
Two details that would ordinarily leak a visit to somebody else, and here do not: the brand fonts are served from our own domain rather than a font network, and the images on these pages are our own files rather than embeds. Apart from the page-view count above, loading this page tells nobody else that you loaded it.
Our host, Vercel, may set a cookie that is strictly necessary to route or protect a request — for example while mitigating an attack. We do not control that, it carries no information about you, and it is not used to build any profile.
4.Cookies in the Oskii product
In the Oskii product, signing in sets one of two cookies. Both do the same job — keeping somebody signed in — and both are strictly necessary. The staff cookie is for store staff at the counter. The other is for a store owner or a collector, whichever of those you signed in as.
| Cookie | What it does | Lifetime | Category |
|---|---|---|---|
| __Host-staff_session | Keeps a staff member signed in to the pick list after they enter their PIN, so they sign in about once a shift rather than on every tap. HttpOnly, Secure and SameSite=Lax, so it is unreadable to scripts and is not sent from other sites. | 12 hours | Strictly necessary |
| better-auth.session_token | Keeps a store owner or a collector signed in: a store owner to the admin pages, where inventory imports and staff accounts are managed, and a collector to their own collection, want list and followed shops. Set by our authentication library, better-auth. Over https the browser stores it as __Secure-better-auth.session_token. | Up to 7 days, renewed while in use | Strictly necessary |
Neither cookie follows you anywhere. They are readable only by Oskii, only over an encrypted connection, and never by JavaScript running in the page. Signing out deletes the staff cookie on that device immediately.
The customer kiosk
The kiosk is a native iPad app locked to a single screen, not a web browser, so no cookies are involved in searching for cards or submitting a fetch request. Card images load directly from Scryfall’s servers, which means the iPad contacts Scryfall to fetch a picture; we send Scryfall nothing about who is looking, and those requests are not used to set a cookie on the device.
5.What we do not use
To be explicit, because “we value your privacy” is usually where a policy stops being specific. One measurement tool runs on this site, and it is named in section 3: Vercel Web Analytics, counting page views without a cookie or an identifier. Beyond that one:
- no Google Analytics, and no second measurement tool beyond the one named above;
- no advertising network, retargeting tag or conversion pixel;
- no Facebook, LinkedIn, X or TikTok pixel;
- no session-recording or heatmap tool;
- no device fingerprinting;
- no data broker, and no sale or sharing of anything a cookie could collect.
An earlier version of this page promised that if we ever added analytics we would update this page before it went live. We added analytics, and this is that update: the copy and the script were merged together, so neither reached the site ahead of the other. The promise carries on in the same terms. If we add something that needs a cookie, or that wants to keep anything in your browser, this page changes before it ships, and in places where the law requires consent we will ask you first rather than set it and mention it later.
7.Changes, and how to reach us
If this changes — most likely because we added a cookie the product needs — we will update the table above and change the “last updated” date at the top of this page. If a change means setting a cookie that is not strictly necessary, we will ask for consent before setting it, not afterwards.
Questions go to hello@oskii.app. This policy sits alongside our Privacy Policy, which covers everything else we do with personal information, and our Terms of Service.
Questions about this document? Email hello@oskii.app. A human reads it.