PAINTSESSIONS.COM

Legal

Cookie Policy

Last updated October 8, 2026

1. Overview

PAINTSESSIONS.COM currently uses only necessary cookies and browser storage for login, security, account and session continuity, paint-app preferences, local saves, multiplayer operation, and technical platform operation.

In Germany, storing information on your device and accessing information already stored on your device, including cookies, localStorage, sessionStorage and IndexedDB, are governed by ยง 25 TDDDG. We use these technologies without separate consent only where they are strictly necessary to transmit communications, provide a digital service expressly requested by you, or provide requested security, login, session, local-save or app-functionality features.

PAINTSESSIONS.COM does not currently use non-essential analytics cookies, advertising cookies, third-party tracking cookies, Google Analytics, Google Ads, or similar tracking technologies.

2. Necessary Authentication Cookies

paintsessions_refresh is a first-party, necessary authentication cookie provided by PAINTSESSIONS.COM. It stores the refresh token used to continue a logged-in session without exposing that token to JavaScript.

  • Provider: PAINTSESSIONS.COM.
  • Purpose: account login, session continuity, token refresh, OAuth login completion, and logout.
  • Path: /auth/v1/auth.
  • Security settings: HttpOnly, SameSite=Lax, and Secure in production.
  • Duration: max age is set from the refresh token expiry returned by the authentication service. The cookie is rotated when the server issues a new refresh token and cleared on logout with a zero max age.
  • Strictly necessary: yes, for secure login, refresh-token handling, session continuity and logout.

The authentication service creates, rotates, and clears this cookie during password token, refresh, OAuth complete, and logout flows.

During /sso login and social-login broker flows, the self-hosted authentication provider may set its own necessary authentication cookies to complete the login process, keep the provider session consistent, protect redirects, and return the user to PAINTSESSIONS.COM. Cookie names can vary by provider version and configuration, so this policy describes those cookies by purpose rather than by fixed names.

  • Name: authentication-provider login, session, state and redirect-protection cookies used during /sso flows; names may vary by provider version and configuration.
  • Provider: PAINTSESSIONS.COM self-hosted authentication system.
  • Purpose: account login, social-login broker completion, redirect protection, authentication-session consistency and return to PAINTSESSIONS.COM.
  • Duration: normally session-limited or limited by the authentication-provider login/session configuration. OAuth state records expire after 5 minutes and OAuth handoff tokens expire after 2 minutes by default.
  • Strictly necessary: yes, for requested login and social-login flows.

OAuth redirect state and handoff records are stored server-side. The OAuth state token may appear briefly in browser redirect URLs during the provider redirect, and the handoff token may appear briefly on the hub callback URL so the hub can finish the social-login flow.

3. Hub Browser Storage

The hub uses local browser storage only for necessary authentication coordination, session restoration, and requested notification state:

  • paintsessions.auth.loginProvider: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers the last successful login provider so the hub can restore the correct session flow. Duration: written after login and removed when the stored provider is cleared or the user signs out. Strictly necessary: yes, for restoring the requested account/session flow where used.
  • paintsessions.auth.refreshLock: localStorage. Provider: PAINTSESSIONS.COM. Purpose: short-lived cross-tab refresh lock so multiple open tabs do not refresh the session at the same time. Duration: 10-second time-to-live and removed after the refresh tab releases it. Strictly necessary: yes, for secure and stable session refresh across tabs.
  • paintsessions.hub.notificationsSeen:v1:<accountId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers the latest engagement notifications viewed for the signed-in account so notification badges remain consistent between the hub and paint client on this browser. Duration: until updated, overwritten, or cleared through browser/app actions. Strictly necessary: yes, for the requested notification and interface-state behavior.

4. Paint App Storage

The paint app uses browser storage to keep local saves, preferences, rendering choices, and multiplayer identity available on the same device:

  • graff-factory-db: IndexedDB database with a sessions object store. Provider: PAINTSESSIONS.COM. Purpose: local paint-session saves by level. Duration: remains on the device until overwritten, replaced, or cleared through browser or app actions. Strictly necessary: yes, for the requested local-save feature.
  • paintsessions-checkpoint-cache: IndexedDB database with a checkpoint-surfaces object store. Provider: PAINTSESSIONS.COM. Purpose: stores recently downloaded paint checkpoint image data locally so rooms and reviews load faster and repeated downloads are reduced. Duration: automatically capped and cleaned up by the app or browser, and removable through browser storage controls. Strictly necessary: yes, for requested paint-app loading performance and technical platform operation.
  • graff.networkMode: localStorage. Provider: PAINTSESSIONS.COM. Purpose: selected network mode, such as singleplayer or multiplayer. Duration: until changed, overwritten or cleared through browser/app actions. Strictly necessary: yes, for the requested network-mode behavior.
  • graff.playerId: localStorage. Provider: PAINTSESSIONS.COM. Purpose: stable local paint player identity for multiplayer and related paint-app behavior. Duration: until replaced or cleared through browser/app actions. Strictly necessary: yes, for multiplayer identity and related requested paint-app behavior.
  • paintsessions.multiplayer.resume.<playerId>: sessionStorage. Provider: PAINTSESSIONS.COM. Purpose: supports multiplayer reconnection and session continuity. Duration: until replaced, cleared, or the browser tab or window session ends. Strictly necessary: yes, for requested multiplayer functionality.
  • graff.rendererPreference: localStorage. Provider: PAINTSESSIONS.COM. Purpose: paint renderer mode, such as automatic selection, WebGPU, or WebGL. Duration: until changed or cleared through browser/app actions. Strictly necessary: yes, for the requested renderer preference.
  • graff.qualityMode: localStorage. Provider: PAINTSESSIONS.COM. Purpose: graphics quality mode and the resolved quality tier. Duration: until changed, overwritten or cleared through browser/app actions. Strictly necessary: yes, for requested rendering-quality behavior.
  • graff.graphicsSessionActive: localStorage. Provider: PAINTSESSIONS.COM. Purpose: temporary paint-app graphics recovery marker used to detect when the previous graphics session did not shut down cleanly and automatically lower graphics quality on the next start. Duration: normally removed on clean shutdown; otherwise overwritten or cleared through browser/app actions. Strictly necessary: yes, for requested app stability and graphics recovery behavior.
  • graff.soundEnabled: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers whether paint-app sound is enabled or muted. Duration: until changed, overwritten or cleared through browser/app actions. Strictly necessary: yes, for the requested sound preference.
  • graff.clientSettings: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers look sensitivity, render-resolution overrides, paint resolution, paint streaming, paint-memory eviction, and separate ambient, tool and footstep volume settings. Duration: no fixed expiry; retained until changed, reset where the app provides that option, or cleared in the browser. Used to preserve your requested control, graphics and sound preferences.
  • graff.controlsTutorial:v1:desktop and graff.controlsTutorial:v1:tablet: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers the current tutorial step and whether the tutorial was completed or skipped, separately for desktop and touch controls. Duration: no fixed expiry; updated as you progress, skip or restart the tutorial, or removed when browser storage is cleared. Used to resume the tutorial and remember your onboarding choices.
  • graff.extraToolHelp:v1:<toolId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers that you acknowledged an Extras tool's introduction so it does not repeatedly interrupt use of that tool. Duration: no fixed expiry; retained until browser storage is cleared. Used to remember your tool-help acknowledgement.
  • graff.savedLocations:v1:<accountId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: stores Saved Spot locations for the account on this browser, including room and level identifiers, in-game position, viewing direction and save time. This is an in-game location, not your device's geographic location. Duration: no fixed expiry; a room's spot remains until replaced, cleared in Saved Spot or removed through browser storage controls. The app keeps at most 50 room entries per account and removes the oldest when that limit is exceeded. Used to provide the requested save-and-return feature; no paint or images are stored in this record.
  • paintsessions.ghostMode:v1:<playerId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers your selected ghost-mode preference; the server still checks whether the account may use it. Duration: no fixed expiry; retained until changed or cleared in the browser. Used to restore your requested visibility preference.
  • graff.playerMutes:v1:<playerId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers the player identifiers you have muted, separately for your local player identity, up to 500 entries. Duration: no fixed expiry; retained until you unmute players or clear browser storage. Used to preserve your requested chat preferences.
  • graff.recentPaintColors:v1: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers recent and pinned paint colours for reuse in the painting controls. Duration: no fixed expiry; updated as your colour choices change or removed when browser storage is cleared. Used for your requested paint-tool preferences.
  • graff.replayRecordingEnabled: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers whether replay recording is enabled. This value stores the setting, not the recording itself. Duration: no fixed expiry; retained until changed or cleared in the browser. Used to preserve your requested replay setting.
  • graff.productNewsDismissed:v1:<entryId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers that a specific in-app product-news notice was closed or followed so the same notice is not shown again. Duration: until overwritten or cleared through browser/app actions. Strictly necessary: yes, for the requested notice-dismissal and interface-preference behavior.
  • graff.communityHubSeen:v1: localStorage. Provider: PAINTSESSIONS.COM. Purpose: remembers that the Community entry in the paint-app menu has been opened so its one-time new-feature badge is not shown again. Duration: until overwritten or cleared through browser/app actions. Strictly necessary: yes, for the requested interface-preference behavior.
  • graff.flareAssistLastShapes: localStorage. Provider: PAINTSESSIONS.COM. Purpose: last flare-assist shape choices used by the paint interface. Duration: until overwritten or cleared through browser/app actions. Strictly necessary: yes, for requested paint-tool continuity.
  • graff.devOverlayState: localStorage. Provider: PAINTSESSIONS.COM. Purpose: developer and diagnostic overlay settings in the paint app. Duration: until overwritten or cleared through browser/app actions. Strictly necessary: yes, for requested diagnostic overlay functionality where used.
  • graff.lastPlayerTransform:<levelId>: localStorage. Provider: PAINTSESSIONS.COM. Purpose: last local player position and view transform for a specific level. Duration: until overwritten or cleared through browser/app actions. Strictly necessary: yes, for requested level/session continuity.
  • paintsessions.pressureDynamics.v1: localStorage. Provider: PAINTSESSIONS.COM. Purpose: brush and stylus pressure dynamics settings. Duration: until changed or cleared through browser/app actions. Strictly necessary: yes, for requested brush/stylus behavior.

paintsessions.paintInterestDebug is also read from localStorage when manually configured for paint-loading diagnostics. It has no fixed expiry and can be removed through browser storage controls.

These paint-app values are local to the browser and are used for functionality, continuity, preferences, and device-specific app behavior. Unlike cookies, localStorage records are not automatically attached to every HTTP request. Some values are used when you request an app action, such as returning to a Saved Spot or joining with ghost mode enabled.

Earlier versions of the app may have left graff.controlsHelpDismissed:v1:desktop or graff.controlsHelpDismissed:v1:tablet from the previous controls-help dialog. The current tutorial does not read or write these legacy entries; they remain until cleared through browser storage controls.

5. Cloudflare Edge And Security Cookies

Where Cloudflare edge, CDN or security features are active for PAINTSESSIONS.COM, Cloudflare may set strictly necessary security or routing cookies on visitor devices.

  • Names: may include __cf_bm for bot-management or bot-fight features, cf_clearance or cf_chl_* for challenge flows, and _cflb where Cloudflare load balancing is active. The exact names depend on the Cloudflare features enabled.
  • Provider: Cloudflare.
  • Purpose: DDoS protection, bot and abuse detection, security challenges, routing, service availability and protection of PAINTSESSIONS.COM.
  • Duration: depends on the active Cloudflare feature and configuration. These cookies are normally short-lived or limited to the configured security challenge, bot-management or routing period.
  • Strictly necessary: yes, where used for security, abuse prevention, service availability or completing a security challenge required to access the service.

PAINTSESSIONS.COM does not use Cloudflare cookies for advertising or non-essential analytics.

6. Social Login, Payments, And External Providers

Google, Discord, and Stripe may use their own cookies or browser storage when you leave PAINTSESSIONS.COM, use Google or Discord social login, or use Stripe payment flows. Those provider cookies and storage are controlled by the relevant provider, not by PAINTSESSIONS.COM.

Provider names, purposes, durations and strict-necessity or consent classifications are determined by the relevant provider. Social-login and payment-provider cookies may be necessary for the external login or checkout flow you request, but they are not set or managed by PAINTSESSIONS.COM.

For links to provider privacy information, see the Privacy Policy.

7. Managing Storage

Signing out asks the PAINTSESSIONS.COM server to clear the first-party paintsessions_refresh cookie. Your browser settings can also be used to clear cookies, localStorage, sessionStorage, and IndexedDB data for PAINTSESSIONS.COM.

Signing out does not automatically clear local paint saves, saved spots, tutorial progress or app preferences. On a shared device, use your browser's site-data controls to remove these records if you do not want them retained.

You can change your control, graphics and volume preferences in Settings, clear a room's Saved Spot through that tool, and restart the tutorial from the menu. Clearing site data removes locally saved artwork and saved spots, resets preferences and may cause the tutorial and tool introductions to appear again. It does not remove your account, published artwork, event signups, server-side Practice Yard introduction progress or moderation restrictions.

Disabling or clearing necessary storage may break login, session continuity, paint saves, app preferences, renderer choices, local player identity, or multiplayer operation.

8. Changes To This Policy

If PAINTSESSIONS.COM adds optional analytics, advertising, or tracking storage in the future, we will update this cookie information and, where required, consent controls before enabling those technologies.

For broader privacy information, see the Privacy Policy. You can contact us at privacy@paintsessions.com.