Oddshelf legal
Cookie & Storage Policy
The short version
- Oddshelf sets one cookie,
os_session, which keeps you signed in. It is strictly necessary, so it does not need consent. - While you sign in with GitHub we briefly set
os_oauth(10 minutes) to protect against forged sign-in requests. - We store two small preferences in your browser: your light/dark theme (
os-theme) and your cookie notice choice (os-consent). - No analytics, no advertising, no tracking pixels, no third-party ad cookies. Fonts are served from our own domain.
- If we ever add analytics, they will stay off until you opt in.
1. What cookies and local storage are
1.1 A cookie is a small text file a website asks your browser to store and send back on later visits. Local storage is a similar browser feature that keeps small pieces of data on your device; unlike cookies, it is not sent to the server automatically.
1.2 Laws such as the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations (PECR) require consent for storing information on your device unless it is strictly necessary to provide a service you asked for. Everything Oddshelf stores falls within that exemption, as explained below.
1.3 This policy is part of our Privacy Policy and is issued by TheMeanOne Developments, which operates Oddshelf.
2. Cookies we set
| Name | Purpose | Type | Attributes | Lifetime |
|---|---|---|---|---|
os_session | Keeps you signed in and links your requests to your Account. Contains a random token; on our side we store only a SHA-256 hash of it, so a database leak would not reveal usable tokens. | First-party, strictly necessary | HttpOnly, Secure, SameSite=Lax | 30 days, or until you sign out |
os_oauth | Set only while you sign in with GitHub. Holds a one-time random value that we check when GitHub sends you back, to protect against cross-site request forgery. | First-party, strictly necessary (security) | HttpOnly, Secure, SameSite=Lax | 10 minutes, removed after sign-in |
2.1 HttpOnly means scripts on the page cannot read the cookie. Secure means it is only sent over HTTPS. SameSite=Lax means the browser does not send it with most requests started by other websites, which helps prevent forgery.
2.2 If you are not signed in and not signing in, Oddshelf sets no cookies at all.
3. Local storage we use
| Key | Purpose | Contents | Lifetime |
|---|---|---|---|
os-theme | Remembers whether you chose the light or dark theme. | The word light or dark | Until you clear your browser storage |
os-consent | Remembers that you have seen and answered the cookie notice, so we do not show it on every page. | Your notice choice | Until you clear your browser storage |
These values stay in your browser. They are not sent to us and contain no personal identifiers. Storing a preference you have expressly chosen is treated as strictly necessary under ePrivacy rules.
4. What we do not use
- No analytics cookies or analytics scripts (for example, no Google Analytics).
- No advertising cookies, retargeting or ad networks.
- No tracking pixels or web beacons, including in our emails.
- No social media "like" or "share" plugins that track you.
- No browser fingerprinting.
- No third-party font requests: our fonts are self-hosted, so loading a page does not send your IP address to Google Fonts or any font service.
5. Third-party services you may visit
5.1 Payment and sign-in pages. When you go to PayPal to pay, to Lemon Squeezy to subscribe, or to GitHub to sign in, you are on their websites, and they set their own cookies under their own policies. We do not control or receive those cookies.
5.2 External download hosts. If a Creator's file is hosted on GitHub Releases, MediaFire, Google Drive, MEGA, Dropbox or another site, following that link takes you to that site, which may set cookies.
5.3 Browser games. Browser games run in a sandbox on a separate domain. A game made by a Creator may use its own browser storage (for example to save your progress) on that domain. The game domain cannot read your os_session cookie. If a game embeds third-party services, the Creator is responsible for telling you and, where needed, asking for consent.
5.4 Security infrastructure. Our hosting and security provider, Cloudflare, may set strictly necessary security cookies (such as a bot-management or challenge cookie) when needed to protect the site from attacks. These are used only for security, not tracking, and are described in Cloudflare's cookie policy.
6. The cookie notice
Because we only use strictly necessary storage, we do not need your consent. We still show a short notice so you know what we store; your answer is remembered in os-consent. If we ever add anything non-essential (for example privacy-friendly analytics), it will be off by default, the notice will ask for your opt-in, and you will be able to change your mind at any time from the same place. We will update this policy before that happens.
7. How to control cookies and storage
- Sign out to end your session and remove
os_session. - Use your browser settings to view and delete cookies and site data for oddshelf.io. Most browsers can also block cookies entirely.
- If you block
os_session, you can still browse but you will not be able to sign in, buy, comment or use your Library. - Clearing site data removes
os-themeandos-consent; we will simply show the default theme and the notice again.
8. Changes and contact
We will update this policy, with a new date and version, before we change what we store in your browser. Questions: [email protected].
Back to top