Cookie Policy

This Cookie Policy explains which cookies Project Real uses on projectreal.net and api.projectreal.net. It is part of our Privacy.

1. Summary

We currently use essential cookies for login, CSRF protection, cookie preferences, and Cloudflare security. We do not use analytics, advertising, or marketing cookies on projectreal.net as of May 2026.

Legal basis: Where GDPR-style laws apply, cookies and related personal-data processing listed below are used for performance of a contract (account login, license redemption, account management) and for legitimate interests in IT security, fraud prevention, CSRF protection, and abuse prevention. Non-essential cookies would require consent before use in regions where that is required.

2. Cookies set by Project Real

Name	Domain	Purpose	Duration	Attributes	Type
`account_session`	`projectreal.net`	Keeps you signed in and lets the API verify authenticated account requests.	24 hours standard; 30 days if "Remember me" or Discord sign-in is used	HttpOnly Secure SameSite=Lax	Essential
`account_csrf`	`projectreal.net`	Protects account actions against CSRF. Because it uses Domain=projectreal.net, browser DevTools may show it under both the main site and API subdomain; this is one domain-scoped cookie.	Matches the account_session duration	JS-readable Secure SameSite=Lax	Essential
`real_cookie_consent`	`projectreal.net`	Stores your cookie preference so the banner does not appear on every visit.	1 year	JS-readable Secure SameSite=Lax	Essential

3. Third-party cookies

Name	Provider	Purpose	Duration	Attributes	Type
`cf_clearance`	Cloudflare	Shows Cloudflare that your browser passed a security challenge, so the challenge is not repeated on every request.	Set by Cloudflare challenge configuration; valid only while Cloudflare accepts the clearance	Secure SameSite=None Partitioned	Essential
`__cf_bm`	Cloudflare	Cloudflare Bot Management cookie used to help distinguish normal traffic from automated abuse.	30 minutes of inactivity	HttpOnly Secure SameSite=None	Essential

For Cloudflare's full cookie documentation and their data processing practices, see Cloudflare Cookies and the Cloudflare Privacy Policy.

4. Cookie security

HttpOnly — JavaScript cannot read the cookie. Used for account_session.

Secure — The browser only sends the cookie over HTTPS.

SameSite=Lax — Helps block most cross-site request attacks while keeping normal login/navigation flows working.

JS-readable — Our frontend can read this cookie. Used only for the CSRF token fallback and preference storage.

5. Why no opt-in for essential cookies?

In regions with cookie-consent rules, non-essential cookies normally require consent. The cookies listed above are essential because they provide login, account security, preference storage, and bot protection. If we add analytics, advertising, or other non-essential cookies later, we will ask for consent first where required.

6. Managing and deleting cookies

You can view, block, or delete cookies in your browser at any time. Blocking essential cookies will prevent login, dashboard access, and ad-step redemption from working.

Chrome / Edge: Settings > Privacy and security > Cookies and other site data > See all site data and permissions
Firefox: Settings > Privacy & Security > Cookies and Site Data > Manage Data
Safari: Settings > Privacy > Manage Website Data
Mobile browsers: Clear browser data or site-specific data in your browser's settings app.

7. Your consent settings

Your current settings

8. Third-party ad-wall providers

Free license keys may use ad-wall providers such as Work.ink. When you leave Project Real and enter that flow, their own cookie and privacy policies apply: work.ink.

9. Changes to this policy

We update this Cookie Policy when our website, backend, or legal requirements change. Material changes will be announced via our Discord server. The latest version is always at projectreal.net/cookies.

10. Contact

Cookie and privacy questions: [email protected]. Full data processing information: Privacy.

Last updated: May 14, 2026.