NDERDOGS1. Your choice
Effective date: 5 October 2026. Last updated: 5 October 2026.
Necessary technologies operate without optional consent. Media, Preferences and Analytics are off until you choose. Accept All enables all three; Reject Optional keeps them off. Preferences lets you select them separately. Scrolling, continued browsing, login and Terms acceptance do not grant optional consent.
Change or withdraw your choice here at any time. It applies across this browser, including after login, not across devices.
2. Necessary authentication and security
__Secure-underdog.session_token — first-party Better Auth credential. Persistent sessions last up to 30 days and can renew; no-remember uses a browser-session cookie. __Secure-underdog.dont_remember records that choice. __Secure-underdog.state protects Google sign-in, normally for five minutes.
__Host-underdog_visitor — signed Battle/report integrity identifier, up to one year. It binds issued Battles to visitors and protects votes, including sponsored votes. Reuse for promotional frequency history requires Analytics consent; without it, sponsorship opportunities use contextual random selection, not visitor cadence history. It is not shared with an advertising network.
__Host-underdog_snippet_guest — guest feedback integrity, up to 180 days; __Host-underdog_snippet_verified — successful guest security check, up to 30 minutes. __Host-underdog_admin — administrator session, up to eight hours. Secure prefixes can differ during local development.
3. Necessary preference and transaction storage
underdogs:consent stores categories, policy version and choice timestamp in first-party local storage. No automatic expiry is set; it remains until changed or cleared. Material category/purpose changes require a new choice. If storage is blocked, the choice works on this page but may be requested again on a new visit.
underdogs-challenge-return holds a requested challenge return path during YouTube connection/import and is removed after return. fires-pending-purchase, fires-checkout-return:… and fires-celebrated:… use tab-session storage for checkout returns and avoiding duplicate confirmation animations. Pending/return values are cleared on completion; confirmation markers last for the tab session.
4. Optional Preferences
underdogs:public-ranking:v1:…, underdogs:public-artist:v1:… and underdogs:public-song:v1:… remember displayed ranking positions locally for later comparisons, only with Preferences enabled. They are not sent to an analytics provider. No automatic expiry is set; replacement, withdrawal or browser clearing removes them. Current rankings still work without stored previous-visit comparisons.
5. Optional Media — YouTube
YouTube iframes and the IFrame Player API do not initialize before Media consent. A player placeholder lets you enable Media directly, without enabling other categories. Playback then works across tracks and pages. Withdrawal removes active players and prevents future initialization; it cannot undo earlier disclosures or cancel every request already in flight.
We use youtube-nocookie.com privacy-enhanced embeds, not a guarantee of zero cookies or tracking. YouTube can contact Google services, process device/referrer/playback data and serve content or advertising. Cookies can include session YSC and persistent VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-YNID and rollout/security cookies. Provider/browser settings determine names and lifetimes; UNDERDOGS does not control them. Provider storage may need separate browser clearing.
Ordinary catalog thumbnails and artist images can load before consent from image hosts including i.ytimg.com and yt3.ggpht.com. They disclose network information but do not initialize players or our optional measurement identifiers. See Google Privacy and privacy-enhanced mode.
6. Optional Analytics and first-party processing
underdogs:tournament:… stores tab-session identifiers for tournament page views and sponsor impressions/click measurement only with Analytics consent. Analytics also permits visitor-based sponsored-Battle frequency history. Without it, sponsored Battles can still appear without that history; the security token remains necessary for validating each vote. Withdrawal removes identifiers and stops future optional measurement initialization, not previously stored server events. No Google Analytics, Meta Pixel, TikTok Pixel or Hotjar is integrated. Requested account interactions, votes and first-party server-side recommendation/swipe processing continue; the panel does not disable service security. Account permission for geographic/commercial insights remains separate. See Privacy.
7. Requested external services
Cloudflare Turnstile can load on protected forms/actions for abuse prevention, independently of optional consent. Clearance/security cookies depend on deployed configuration; see Turnstile privacy. Google/Twitch sign-in and Stripe/Link payment pages use provider technologies when you request those flows; see Stripe cookies. Deals uses outbound links, not globally loaded partner tracking scripts.
8. Browser controls and contact
You can clear or block cookies/site data in your browser. Clearing credentials signs you out; clearing consent restores the choice panel. Browser clearing does not delete account/server records. See Privacy or Contact / Legal for data requests. This inventory describes our application, not every technology a provider may subsequently use.