This policy explains how clutx.site uses cookies and similar technologies such as local storage. In short: we only use what the site needs to work, one cookie that remembers the language you pick (only once you pick one), and, if you open someone's invite link, one cookie that remembers who invited you while you sign up. Profile pages also remember, only in your browser, which profile pages you opened and what their stats were then, so they can show you what changed since (section 2, where you can turn it off). We don't use advertising cookies, cross-site tracking or third-party analytics. Clips and songs from YouTube or Spotify on profiles work differently: pressing play on one loads that platform's own player, which may set the platform's own cookies (see section 3). Nothing loads from the platform before then.
1. What are cookies?
Cookies are small text files a website stores in your browser. Local storage is a similar browser feature. Both let a site remember things, such as the fact that you are logged in.
2. Cookies we use
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-*-auth-token | Strictly necessary (first-party cookie) | Keeps you logged in to your dashboard and secures your session. Set by Supabase Auth only when you log in. | Up to 400 days, renewed while you use the site. Removed when you log out |
sb-*-code-verifier | Strictly necessary (first-party cookie) | Set by Supabase Auth while a sign-in is in progress: when you sign up with email or ask for a password reset link. It holds a one-time secret that lets us finish that sign-in securely when you come back to the site (which is why a reset link only works in the browser that asked for it). | The secret stops working once used. The cookies are cleared when you log out, or after 400 days at most |
__Host-google_oauth | Strictly necessary (first-party cookie), only while you sign in with or connect Google | Set when you press Continue with Google on the log-in or sign-up page, or Connect next to Google in Dashboard → Account → Connections, just before you go to Google's sign-in page. It holds a random one-time code, two one-time secrets for finishing the sign-in securely and, when you connect Google, your account ID and a one-way fingerprint of your current login (when you sign up, the username you typed, if any), so that when Google sends you back we can check that you started the sign-in, in this browser and this login. Your browser sends it only to clutx.site, where only our Google sign-in reads it, and never to anyone else. | 10 minutes at most. Deleted as soon as you come back from Google |
__Host-discord_oauth | Strictly necessary (first-party cookie), only while you sign in with or connect Discord | Set when you press Continue with Discord on the log-in or sign-up page, or Connect next to Discord in Dashboard → Account → Connections, just before you go to Discord's authorization page. It holds a random one-time code, a one-time secret for finishing the sign-in securely and, when you connect Discord, your account ID and a one-way fingerprint of your current login (when you sign up, the username you typed, if any), so that when Discord sends you back we can check that you started the sign-in, in this browser and this login. Your browser sends it only to clutx.site, where only our Discord sign-in reads it, and never to anyone else. | 10 minutes at most. Deleted as soon as you come back from Discord |
steam_openid | Strictly necessary (first-party cookie), only while you connect Steam | Set when you press Connect next to Steam in Dashboard → Account → Connections, just before you go to Steam's sign-in page. It holds a random one-time code and your account ID, so that when Steam sends you back we can check that you started the sign-in, in this browser. It is only sent to our Steam sign-in address and never to anyone else. | 10 minutes at most. Deleted as soon as you come back from Steam |
riot_rso | Strictly necessary (first-party cookie), only while you connect a Riot account | Set when you press Connect next to Riot Games in Dashboard → Account → Connections, just before you go to Riot's sign-in page. It holds a random one-time code, a one-time secret for finishing the sign-in securely, and your account ID, so that when Riot sends you back we can check that you started the sign-in, in this browser. It is only sent to our Riot sign-in address and never to anyone else. | 10 minutes at most. Deleted as soon as you come back from Riot |
__Host-github_oauth | Strictly necessary (first-party cookie), only while you connect GitHub | Set when you press Connect GitHub in Dashboard → Page → Stats → GitHub, just before you go to GitHub's sign-in page. It holds a random one-time code, a one-time secret for finishing the sign-in securely, your account ID and a one-way fingerprint of your current login, so that when GitHub sends you back we can check that you started the sign-in, in this browser and this login. Your browser sends it only to clutx.site, where only our GitHub sign-in reads it, and never to anyone else. | 10 minutes at most. Deleted as soon as you come back from GitHub |
lang | Strictly necessary (first-party preference cookie), only after you pick a language | Set when you choose a language in the menu at the bottom of the page, on the log-in and sign-up pages or in Dashboard → Account → Settings. It holds only the language you chose (en for English, es for Español, pt-BR for Português (Brasil)) so every page shows in it. Until you pick one, each page follows the language your browser asks for, which isn't stored. It isn't used for anything else and is never sent to anyone else. To go back to your browser's language, delete it in your browser settings. | 1 year, renewed each time you pick a language |
invited_by | Functional (first-party cookie), only after you open an invite link | Set when you open someone's invite link (a link to clutx.site ending in ?ref= and their username). It holds only that username, so that if you sign up, also with Google or Discord, we know who invited you (see "Invites" in our Privacy Policy). It is only read when you sign up and is never sent anywhere else. To remove it, press Remove next to "Invited by" on the sign-up page. | 24 hours, or until you finish signing up or press Remove |
team_join | Functional (first-party cookie), only after you open a team's invite link | Set when you open a team's invite link (a link to clutx.site/team/ ending in /join?code= and the team's code). It holds only the team's address and that code, so that if you log in or sign up first, also with Google or Discord, your dashboard offers to join the team (see "Team pages" in our Privacy Policy). It is never sent anywhere else. To remove it, press Not now on the invite in Dashboard → Page → Team (or Dismiss, when you can't join with it). | 24 hours, or until you join the team or press Not now or Dismiss |
cookie-notice-v1 | Strictly necessary (local storage) | Remembers that you closed the cookie notice so it doesn't appear again. | Until you clear your browser storage |
setup-checklist-v1:<account ID> | Strictly necessary (local storage) | Only in your dashboard, and only once you copy or share your page link there (the top bar's copy button or the Share panel) or collapse, hide or reopen the "Set up your page" checklist: remembers whether you shared your link and whether the checklist is collapsed or hidden, so it doesn't ask again. It stays in your browser and is never sent to us. | Until you clear your browser storage |
clutx-visits-v1 | Functional (local storage), only on profile pages | Which profile pages you opened on this browser (the last 50), when you last opened each one, and the numbers its game rows showed you then, such as ranks, wins and trophies, with a short fingerprint of each game account instead of its name. The next time you open one of those pages, a button at the end of its Stats heading shows you what changed since your last visit. It stays in your browser and is never sent to us or anyone else, but someone who uses this browser after you can tell that a page was opened on it before. "Don't remember my visits" (at the end of "Since your last visit" on a profile, or here) deletes all of it and stops it: from then on it only keeps that choice, until you turn it back on here. | Until you clear your browser storage or press "Don't remember my visits". A page you haven't opened for a year is forgotten and never shown |
Under EU/UK ePrivacy rules, strictly necessary cookies do not need consent. The language cookie is only set when you pick a language, and only remembers that choice. The invite cookie is only set when you open an invite link, and only does what that link is for: telling us who invited you if you sign up. It isn't used to track you, and you can remove it. The same goes for the team invite cookie: only set when you open a team's invite link, and only used to offer you that team. That's why we show a notice rather than an accept/reject choice. The local storage behind "Since your last visit" keeps which profile pages were opened on this browser, when, and the numbers they showed. It never leaves your browser and isn't used to track you, and "Don't remember my visits" (on a profile, or in the table above) deletes it and stops it, as clearing this site's data in your browser settings deletes it. Clip and music players (section 3) only load when a visitor chooses to play a clip or a song.
3. Profile pages and third-party content
Profiles and their stats pages, the leaderboard and the dashboard show pictures from other services (game pictures, Discord avatars and Spotify album covers in the live Discord status, and profile pictures from Google or Discord sign-in) and the pictures, songs and videos people upload. Valorant rank emblems and agent portraits are our own copies of Riot's artwork. All of them are loaded through clutx.site: our server fetches them and sends them from our own address, so your browser doesn't contact those services or our storage provider for them, and they can't set cookies through our pages. The Discord status itself comes from our own database: the page keeps a connection open to our database provider (Supabase) to receive changes, without cookies. The LIVE banner and stream schedule are drawn by our site: the live status comes from our own server (which asks Twitch and Kick), so nothing loads from Twitch or Kick and they can't set cookies, unless you follow the banner's link to the stream. Counter-Strike 2 stats are drawn by our site too, from what Steam returns to our server. Steam avatars and game icons come from our own server, which gets them from Steam, so nothing loads from Steam on our pages and it can't set cookies, unless you follow a link to a Steam profile. Connecting Steam in Dashboard → Account → Connections takes you to Steam's own sign-in page (steamcommunity.com), where Steam's own cookies and policy apply. Connecting a Riot account there takes you to Riot's own sign-in page (auth.riotgames.com), where Riot's own cookies and policy apply. Valorant stats are drawn by our site too, from what Riot or HenrikDev returns to our server, so nothing loads from them on our pages. Connecting GitHub in Dashboard → Page → Stats takes you to GitHub's own sign-in page (github.com), where GitHub's own cookies and policy apply. The GitHub widget is drawn by our site from what GitHub returns to our server, and its avatar comes from our own server, so nothing loads from GitHub on our pages either. The Copy button next to a crosshair code only writes to your clipboard when you press it, and stores nothing. View counts and the GG button use a hashed identifier that is not stored in a cookie, and the GG button stores nothing in your browser (if you are logged in, your login cookie is sent with a view, a link click or a GG only so your own page's views and clicks don't count you and you can't GG it). See our Privacy Policy.
Your browser only connects to other sites in these cases, each described in this policy:
- Supabase, our database and login provider: when you log in, sign up or use your dashboard, and while a page with a Discord widget is open;
- a clip's player (YouTube, Twitch, Medal or Streamable) or a song's player (YouTube or Spotify), only after you press play on it;
- sites you choose to go to: a link you follow, PayPal when you open it to pay for Premium (PayPal's own cookies and policy apply there), and Google, Discord, Steam, Riot or GitHub when you sign in with them or connect them.
Clips and music
Profiles can show clips from YouTube, Twitch, Medal and Streamable, and songs from YouTube or Spotify. Until a visitor presses play, a clip or song is just a play button and a title drawn by our site: nothing is requested from the platform and it can't set cookies. The enter screen some profiles have never starts one. Pressing play loads that platform's player in a frame on the page. While a song's player is open, the previous and next buttons some profiles have switch it to another song from the same platform; a song from the other platform waits until you press play on it. The player comes from the platform, not from us, and it may set its own cookies or use local storage, for example to remember your volume, count views, prevent abuse or, depending on the platform, for analytics or advertising. Those cookies are covered by the platform's own policy. We can't read or control them.
| Platform | Player loads from | Their policy |
|---|---|---|
| YouTube | www.youtube-nocookie.com (YouTube's privacy-enhanced mode) | Google Privacy Policy |
| Twitch | clips.twitch.tv | Twitch Privacy Notice |
| Medal | medal.tv | Medal Privacy Policy |
| Streamable | streamable.com | Streamable Privacy Policy |
| YouTube (songs) | www.youtube-nocookie.com (YouTube's privacy-enhanced mode), the same player as YouTube clips | Google Privacy Policy |
| Spotify (songs) | open.spotify.com. Spotify's player sets its own cookie, sp_t, for about a year as soon as it loads, before anything plays, and may set others. It plays a 30-second preview unless you're logged in to Spotify in that browser. | Spotify Privacy Policy and Cookie Policy |
If you don't want these cookies, don't press play on clips or songs, or block third-party cookies in your browser.
4. Managing cookies
You can block or delete cookies in your browser settings. If you block the authentication cookie you will not be able to log in, but public profiles will still work.
5. Changes
If we ever add non-essential cookies (for example, analytics), we will update this policy and ask for your consent before setting them.
6. Contact
Questions? Email [email protected].