Cookie Policy.

1. What cookies are

Cookies are small files a site stores in your browser to remember something between pages. We also use the browser's local storage (localStorage), which works similarly but is never sent to the server.

2. Cookies we use

All of them are essential: without them you cannot stay logged in or finish signing up through Google or Discord.

• listrated_session — keeps you logged in. It is httpOnly, SameSite=Lax and Secure in production; it holds a random token, and only its hash is stored in the database. Lifetime: 30 days.
• pending_oauth — temporarily holds the identity returned by Google/Discord between authorization and choosing your username. Signed with HMAC-SHA256 and httpOnly. Lifetime: 15 minutes.
• gg_oauth_state and gg_oauth_return — protect Google sign-in against CSRF and remember where to return afterwards. Lifetime: a few minutes.
• dc_oauth_state and dc_oauth_return — the same, for Discord. Lifetime: a few minutes.
• lf_oauth_return — the same, for connecting Last.fm. Lifetime: a few minutes.

3. What stays in your browser

• gaming-profile:locale — the language you picked (PT/EN). It applies to this browser only.
• listrated:library-patches — a local cache of your latest library edits so the interface responds instantly. It disappears when you clear the site's data.

4. What we do NOT use

• Advertising, remarketing or data-selling cookies.
• Social network pixels.
• Third-party analytics tools that build profiles.

If we ever adopt audience measurement, this page is updated before anything is switched on.

5. Third-party cookies in embedded players

When a profile plays music through the official Spotify or Deezer player, or when a YouTube video is embedded, those services may set their own cookies under their own policies. This only happens once that content loads.

6. How to control them

You can block or delete cookies in your browser settings — usually under Settings → Privacy and security → Cookies and site data. Local storage is cleared along with the site's data.

If you block essential cookies, login stops working: you cannot sign in or keep a session. Browsing public profiles still works.

Because we only use strictly necessary cookies, we show no consent banner — Brazilian law does not require prior consent in that case.

7. Changes

If we start using non-essential cookies, this page is updated and a consent request appears before any collection.

8. Contact

Questions about cookies: contato@listrated.com. See also the Terms of Use and the Privacy Policy.