Cookie Policy

Status: published. Prepared against the product as built. A version reviewed by counsel, when issued, replaces this one under its own changes section. Version: 2026-11-04 · Effective: 2026-11-04 · Registry slug: cookie-policy Operator: Moretime.ai Inc., a Texas corporation ("we", "us", "OnTheList.Live") · Contact: hi@moretime.ai · Postal address: 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States

1. Who this is for

This policy is for anyone who opens a page on onthelist.live. It lists every cookie the site can set, who sets it, why, for how long, and where your browser sends it; says what the human check on the two marketing forms keeps in your browser; and tells you how to change your choice about the only ones that are optional. The Privacy Policy covers what we do with the data.

2. What a cookie is

A cookie is a small text file a website asks your browser to keep and send back on later visits. The site that set it can then tell, for instance, that you are the person who signed in a moment ago.

3. The cookies this site sets

Where a cookie is set and where your browser sends it are two different things. Every cookie in the table is set for a whole address (path /), and your browser sends it with every request to that address, whichever page you open there. The host and staff session cookie and the second-factor cookie belong to the address where you signed in — hosts.onthelist.live for a host, admin.onthelist.live for platform staff — and are sent nowhere else. The sponsor session cookie is set for onthelist.live and every address under it, so your browser sends it to the public site, to sponsor.onthelist.live and to our other *.onthelist.live addresses; the public site reads it to save a board and to open a listing's manage page, and the sponsor pages read it. otl-consent and Google's two cookies belong to onthelist.live alone. What differs is who reads it: our server reads a session cookie wherever a page needs to know who is signed in; only /, /scorecard and a board's own pages — the board, its Round Archive, a settled round and its rules — read otl-consent, and only they can load Google's script and send anything to Google (section 4 says when); no other page loads Google's script or sends anything to Google.

The three session cookies are marked Secure, HttpOnly and SameSite=Lax: they travel only over HTTPS, no script on the page can read them, and they are not sent on requests other sites start, except when you follow a link from another site to us. They are opaque handles to a record on our server, not your details.

otl-consent is marked Secure and SameSite=Lax in the same way. It is written and read by our own script on those pages, so it is not HttpOnly; it holds one word, a date and a version.

otl-theme is set for onthelist.live and every address under it, so the host, staff and sponsor pages open dark too once you choose it. It is marked Secure and SameSite=Lax, and it is read only by a small script at the top of each page, never by our server: every visitor is sent the same page, and the script turns it dark before it is drawn. So it is not HttpOnly.

The two Google cookies are first-party: set on onthelist.live alone, not on any other domain, so no other site can read them — though a script we load on the page can, and Google's own script is what sets and reads them. They are set only on the pages named above, and only when section 4 lets Google's script load — after you say yes. Their names and lifetimes are Google's, from its documentation of cookie usage in Google Analytics 4.

The human check on the forms. The forms on / and /scorecard run Cloudflare Turnstile, a check that tells people from automated traffic. It loads Cloudflare's script from challenges.cloudflare.com and runs in a frame of Cloudflare's own inside the form as soon as the form appears — on / whenever the page loads, and on /scorecard once your result is shown — whether or not you submit. It is part of the form, not an optional feature, so it runs whatever you choose about analytics. Cloudflare states that Turnstile sets no cookie, and when we checked it in a browser it set none and kept one item, cf.turnstile.u in the table above, in the local storage of Cloudflare's own frame: an opaque value that differs from one browser to the next and survives a reload, so it can tell one browser from another. Cloudflare does not document what it holds, and our pages cannot read it. A browser that keeps an embedded frame's storage separately for each site that embeds it holds this item for our site alone. Cloudflare states that Turnstile does not use cookies to collect or store information, and that the signals it collects are strictly necessary to detect bots (Turnstile Privacy Addendum). What Cloudflare receives, and why, is in the Privacy Policy, section 7.

Beyond that one item, there is nothing else of ours. Our own code writes nothing to your browser's local storage or session storage, and sets no third-party cookie, no advertising cookie and no tracking pixel. Google Signals, one of Google Analytics' advertising features, is off (section 6), so Google's advertising cookies play no part. Checkout and the sponsor pages, the report form, a shared placement's page, the legal pages, the host dashboard and the admin pages load no analytics script and set no analytics cookie.

4. Your choice about analytics

Google Analytics runs only after you say yes, wherever you are. The first time you open /, /scorecard or a board's own page — the board, its Round Archive, a settled round or its rules — before any Google script loads, the page asks whether you agree to analytics cookies: at the foot of the screen on / and /scorecard, and in the footer of a board's page, under its Cookie settings control. Yes and no are equal buttons. Until you choose, no analytics cookie is set and nothing is sent to Google. If you choose no, otl-consent records denied, Google's script is never loaded, and you are not asked again for twelve months (seven days on Safari, which keeps a cookie a page's script sets no longer). If you choose yes, otl-consent records granted and Google's script loads on those pages, with Google Signals and advertising personalisation off.

Global Privacy Control. A browser that sends a Global Privacy Control signal and has no choice recorded is not asked and loads nothing: our script reads the signal in your browser, before any Google script loads. A choice you make with Cookie settings (section 5), or made before the signal was on, is the one followed. Do Not Track is not read.

A yes you gave before this version still covers / and /scorecard; a board's page asks you again (or, with Global Privacy Control on, stays silent). A _ga cookie kept from an earlier version is removed when you choose no. A no holds everywhere. Declining changes nothing about the service. Every page works the same way, and a board, a bid or an account never depends on the choice.

5. Changing your mind

The footer of /, of /scorecard and of a board's own pages carries Cookie settings, which reopens the choice; a choice made on any of them applies to all. Choosing no after a yes sets otl-consent to denied, stops Google's script from sending anything more in that page view and from loading on your next, and clears the two _ga cookies from your browser. No other page sets these cookies, so there is nothing to change anywhere else. You can also delete any cookie yourself through your browser's settings; deleting otl-consent means the page asks you again.

6. What Google Analytics does with the data

Where it runs (section 4), Google Analytics records:

• a page view of /, /scorecard or a board's own page, carrying the page's address trimmed to its origin and path — of any query string in the link you arrived by, only the campaign tags (utm_…) are kept — the page's title, and a referrer reduced to its origin and path with no query string at all: for the first page counted after your browser loads a page of this site, the referrer your browser reports for the page it loaded; for each later page you reach by a click within the site, the last page counted before it. Google's script would read both whole from your browser, and our page trims them before they are sent. Each page is counted once each time it is shown, a page reached by a click within the site included;
• Google's automatically collected events — first_visit the first time your browser is seen, session_start when a visit begins, and user_engagement while the page has been in focus for at least a second — described in Google's documentation of automatically collected events;
• a coarse location Google derives from the connection, and the kind of device and browser used.

Google's "enhanced measurement" events (how far you scrolled, an outbound link you clicked, a search, a form you started, a video, a download) are turned off in our Google Analytics property, so none of them is recorded. Advertising personalisation is turned off in the configuration our code sends to Google, and sharing of Google Analytics data with Google's other products is turned off in our property.

How long it is kept. Our Google Analytics property keeps each visit's record for 14 months, and what is tied to a browser's _ga identifier for 14 months after that browser's latest visit — each return restarts that clock. Google deletes what has expired once a month. Totals already counted into our standard reports carry no identifier, and that setting does not shorten them.

Google Signals is off: the configuration our code sends to Google turns it off, so Google does not use it to associate a visit with a Google account or to report the age, gender or interests of the visitors it measures for us. Before this version, a visit from a United States time zone that sent no Global Privacy Control signal was measured with it on, as the version then in force said. You can stop Google Analytics on every site with Google's opt-out browser add-on.

Google states that Google Analytics 4 does not log or store IP addresses, and that traffic from the EU, Switzerland and the UK is collected on servers there before being forwarded to Google's servers in the United States. We never put a name, an email address, a scorecard answer or an account detail into what is sent, and an address somebody else typed into a link to our page is trimmed away with the rest of the query string — unless they typed it into one of the link's campaign tags, the one part of it we keep.

How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites, and Google's own privacy policy is at policies.google.com/privacy.

7. Changes to this policy

The version string at the top of this page tells one version from another. If a cookie is added, removed or changes purpose, the version goes up, and if the change adds an optional cookie or a new purpose for one, we will ask you again before it is set. The choice holds a word, a date and the version of this policy it was made under. A choice recorded before versions were kept (a word and a date only) reads as no choice, so the page asks once more; a yes made under a version before 2026-11-04 covers / and /scorecard only (section 4); otherwise a choice made under an earlier version still holds, so asking again after a change is something we do by changing what the page asks, not something the cookie does by itself.

8. Contact

hi@moretime.ai, for every question about this page. It is read by the people who run OnTheList.Live and answered by hand.