Cookie Policy

1. What are cookies?

Cookies are small text files that a website stores in your browser. This policy also covers equivalent browser-storage technologies (localStorage and sessionStorage).

2. Cookies and storage we use

Necessary (no consent required)

Key	Type	Purpose
refresh	HTTP-only cookie	Keeps you signed in (authentication refresh token).
pending_signup	HTTP-only cookie (15 minutes)	Lets you finish creating your account after connecting Steam. Deleted when the account is created or the signup is cancelled.
os_consent	First-party cookie (.overskill.gg, 12 months)	Stores your cookie choice once for this site and the app.
os_session	First-party cookie (.overskill.gg, 30 days)	Tells the site that this browser is signed in to the app, so overskill.gg takes you straight to the app. Holds no identifier and is deleted when you sign out.
os_lang	localStorage	Remembers the language you pick on the marketing site.
os.uiLang	localStorage	App language pin when you choose a language manually.
os:last-game	localStorage	Keeps the last game you visited, for navigation.
region-latency	sessionStorage	Per-region latency for the session, if that probe runs.
Wallet-connector storage	localStorage	Wallet connection state (WalletConnect pairing/session; browser-extension wallets manage their own state separately).
os:age-gate-ack	localStorage	Remembers that this browser affirmed 18+ at Connect with Steam.

First-party measurement without identifiers

These keys are ours (not third-party) and contain no personal identifier. They may be written before you decide on analytics cookies.

Key	Type	Purpose
os_attr	First-party cookie (.overskill.gg, 90 days)	Remembers how you first reached us: the campaign’s UTM tags, the domain of the site that sent you, the entry page, and whether the link carried an ad click ID (only that it did, never its value). Our server reads it once, when your account is created, to know which campaign brought you.
os:analytics:funnel:*	localStorage	One-time markers and funnel clocks (for example, your first match or wallet link).
os:analytics:internal	localStorage	Marks team and test-account devices so they are excluded from analytics.
os:analytics:referred	localStorage	Whether this browser arrived through a referral invite (yes or no, never the code).
os:analytics:entry-referrer	sessionStorage	Keeps, for the session, the domain of the site that sent you while the marketing site redirects you to your language.

Analytics (require your consent)

Key	Type	Purpose
_ga, _ga_MRJXTV87VF	Cookie (Google Analytics 4)	Aggregate measurement of platform usage. Measurement ID G-MRJXTV87VF.

Advertising (require your consent)

Key	Type	Purpose
_fbp, _fbc	Cookie (Meta Pixel)	After you accept advertising cookies, Meta Pixel 1851423562526503 records that you viewed a page, so ads on Facebook and Instagram can be measured. We do not send amounts, wallet addresses, SteamIDs, usernames or codes, and we do not match the visit to your account. Withdrawing advertising consent deletes these cookies.

3. Consent model

We use three categories: essentials (on by default, no consent), analytics (explicit opt-in) and advertising (explicit opt-in). Consent is handled with our own lightweight banner, with no third-party platforms, through a single text that is not versioned per jurisdiction. Your decision applies to both this site and the app. Accepting all grants analytics and advertising together. Choosing essentials only rejects both. We ask again when the categories change. This version adds advertising, so a previous choice is asked again.

Google Analytics runs in consent mode: until you accept analytics cookies, it only sends Google cookieless, identifier-free signals (for example, that a page was viewed), which let us count visits in aggregate. The _ga cookies are set only if you accept. Google’s advertising storage and personalization stay off. The Meta Pixel loads only if you accept advertising cookies, and it sends only that a page was viewed.

4. Legal basis

Essential cookies rely on our legitimate interest in providing the service you request. First-party measurement without identifiers (os_attr, os:analytics:*) and the cookieless signals rely on our legitimate interest in understanding how people find and use the platform, with no identifiers and no use for Google advertising. Analytics cookies and advertising cookies are set only with your prior consent.

5. Managing or withdrawing your consent

You can change your preferences at any time from the cookie-consent panel on this site (footer → Cookie preferences) or in the app; the change applies to both. If you withdraw analytics, we delete the Google Analytics cookies (_ga, _ga_MRJXTV87VF). If you withdraw advertising, we delete _fbp and _fbc. You can also block or delete cookies from your browser settings; note that disabling the essential ones may affect how the platform works.

6. Advertising

Google’s advertising storage and personalization are always off. This version has no “functional” category. Advertising cookies exist only for the Meta Pixel, and only after you opt in. The pixel records a page view. It does not receive amounts, wallet addresses or account identifiers, and it is not matched to your account. There is no TikTok pixel.

7. Third parties

Analytics cookies and the cookieless signals are processed by Google (Google Analytics 4). When you accept advertising cookies, Meta Platforms processes the page view from the pixel. Publishing highlight clips as Instagram Reels is a separate use, described in the Privacy Policy. See our Privacy Policy for how we process that data.

Twitch (Twitch Interactive, Inc.) and Kick (Kick Streaming Pty Ltd) set their own cookies only when you play an embedded stream. A tournament page may embed the Twitch or Kick player of a player who is live, but it does not load it until you press play: before that it shows only a preview (a still image of the stream, avatar, title, and a play button) with a notice that playing loads the provider’s player, which uses its own cookies. The still image and the avatar load from the Twitch or Kick image servers, which receive your IP address as with any image request and set no cookies. Once loaded, the provider sets and reads its own cookies under its cookie policy; OVERSKILL does not set, read, or control them, and they are not in the section 2 inventory. Closing the player (picking another stream or leaving the page) unloads it, but the provider’s cookies stay in your browser until you clear them or the provider expires them. This feature adds no OVERSKILL cookie or storage.

8. Changes

We may update this policy. A category change (a material change) means we ask for your consent again. The current version is identified at the top of this document.