Cookie Policy

The cookies we set

The site loads Google Analytics to count visits. Outside Europe and the UK, Google Analytics sets two cookies on your device, and they are the only cookies this site sets:

• _ga — a randomly generated number that tells one browser apart from another, so a reader who comes back next week is not counted as a new person. It lasts up to two years unless you clear it.
• _ga_3ZBZJQ47RB — the same idea for a single visit: it tracks when your session started and how long it lasted. It also lasts up to two years unless you clear it.

Both are first-party cookies, set by this site on this domain. Neither carries your name, your email or anything you typed, and neither is used to follow you to another website. There is no advertising cookie, no affiliate tag and no social-media pixel.

The cookie you get only if you sign in

Accounts are free and optional — everything on the site is readable without one. If you do sign in, one more first-party cookie is set:

• sb-mnmdaviqnsjwofnkjabz-auth-token — the thing that keeps you signed in between page loads. It holds the session tokens issued to you when you followed your sign-in link. If the value is long it is split across numbered cookies of the same name (…-auth-token.0, …-auth-token.1); that is one cookie in two pieces, not two cookies.

It is set only after you sign in, and never for a signed-out reader. It is what the EU and UK rules call strictly necessary — you asked to be signed in and it is the only way to stay signed in — so no permission is needed for it, and switching analytics off below does not affect it. Signing out removes it. So does clearing this site's data.

It is not analytics and it is not advertising. It is not read by Google, by Vercel or by anyone but this site, and it is never used to work out what you read. If you never sign in, it never exists.

One more thing sets a cookie alongside it, briefly: ticking the age box writes a short-lived marker so that the confirmation survives if you sign in with Google and leave the site for a moment. It lasts ten minutes, records nothing but the fact you ticked the box, and is deleted as soon as you land back here. If you sign in with Google, Google sets its own cookies on its own sign-in pages under its own policies, exactly as it would signing in to anything else — we do not control those and cannot list them.

No banner, and why

Paying is the one journey that leaves our pages — it happens on Stripe's own checkout rather than ours. See "How we measure traffic" below for where our side ends and Stripe's begins.

There is no cookie banner, and there are three reasons it is not needed rather than merely absent. First, the analytics script does not load at all — so no cookie is set and Google is never contacted — for anyone who has switched analytics off on this page or whose browser sends a Global Privacy Control or Do Not Track signal. That check runs before the script is requested. Second, see below: if you are reading this from Europe or the UK, no analytics cookie is set for you in the first place. Third, the only other cookie this site sets is the sign-in cookie described above, which exists solely because you asked to be signed in — the strictly-necessary category, which does not require permission.

Readers in the European Economic Area and the United Kingdom are measured without cookies. The site checks the country your request arrives from and, for those countries, starts Google Analytics in a mode that writes nothing to your device and reads nothing from it — so the two analytics cookies are never created, and there is nothing for you to be asked to agree to. That applies to measurement; if you choose to sign in, the sign-in cookie is set wherever you are, because it is the only way to keep you signed in. The trade is on our side, not yours: we cannot tell a returning European reader from a new one, and we would rather lose that number than put something on your device without asking. If the country cannot be determined for any reason, the cookieless mode is what you get.

What the site keeps in your browser

Separately from the two cookies above, a few preferences are saved in your browser's local storage so that the site remembers what you chose. These stay on your device and are never sent to us or to anyone else:

• Your light-or-dark theme choice (thesportstack-theme).
• Your NFL player-filter selections — position, team, search text and stat window — so the Usage, Projections and Props tabs share them (tss-nfl-players-filter).
• The analytics opt-out flag (ss-no-track), which exists only if you switch analytics off below. It is written twice, as a stored setting and as a cookie of the same name, so that it survives in browsers that keep one but not the other — some automated and privacy-hardened browsers discard stored settings between visits. It records one thing: that you asked not to be counted.
• Two entries used by the site operator's own editing tools. They are never written for visitors.

Each of these is stored because you asked for it — the theme you picked, the filter you set — which is the "strictly necessary" category under EU and UK rules, so no permission is needed for them. That reasoning covers this list only; it does not cover the analytics cookies above, which is why the opt-out exists and why it is checked before anything loads. Clearing your browser's site data for thesportstack.io removes every item on this page, cookies included.

How we measure traffic

Two tools, both counting the same thing — whether anyone is reading the site — from different angles.

Google Analytics 4 records, for each page view: the page address and title, the referring site, the search terms or campaign that brought you if any, your approximate location (country, region, city), your device type, operating system, browser and screen size, and the _ga identifier described above so repeat visits can be recognised. Google processes this on our behalf as our service provider. Google states that it does not log or store the IP addresses of visitors to Google Analytics 4 properties; the address is used to derive the approximate location and is then discarded. We see counts and groupings, never a named person. We do not use Google Analytics for advertising, we have not enabled Google Signals, and nothing collected here is used to build advertising audiences.

Google does not keep that data forever. For this property, event-level data is retained for 14 months and user-level data for 14 months; after that Google deletes the underlying records and only aggregate reporting remains. Google Signals is off, so nothing measured here is joined to a Google account. That retention is a setting on Google's side and is separate from the cookie lifetimes listed above, which are on your device — the same 14-month figures are stated in the Privacy Policy (/privacy).

Vercel Web Analytics, run by the company that hosts the site, records per page view: the time, the page address and the page pattern it belongs to (an NFL game page, say, rather than which game), the referring site, filtered query parameters, approximate location, operating system, browser and device type. It sets no cookie and stores no IP address; it tells one page view from another with a hash of the incoming request that is discarded after 24 hours, so you cannot be recognized tomorrow.

One more thing sits outside all of this: paying. Where the site offers paid access, the payment is taken by Stripe, and the checkout page you enter your card on is Stripe's, not ours. Stripe sets its own cookies there and runs its own fraud-detection and security processing, under the Stripe Privacy Policy (https://stripe.com/privacy) and Stripe's cookie notice — we do not control what it sets, and we cannot list those cookies for you the way we list ours above. Stripe may also load fraud-detection code on our own pages in the checkout journey. None of that is analytics, none of it is advertising, and the switch below does not govern it; what we receive back from Stripe is set out in the Privacy Policy (/privacy) under "Payments and Subscriptions".

Vercel Speed Insights records how fast each page loaded on your device — the page, the timing measurement, network speed, browser, device type, operating system and country. It sets no cookie and is not tied to any individual visitor.

Switch analytics off

One control turns off all three tools. If you would rather not be counted, any of these works:

• Use the switch at the bottom of this page. It sets the ss-no-track flag in your browser. Google Analytics is then never loaded, so no cookie is set and no request reaches Google; the Vercel tools drop every event before it is sent.
• Open https://thesportstack.io/?ss-no-track=1 in the browser you want excluded (and ?ss-no-track=0 to undo it).
• Turn on Global Privacy Control or Do Not Track in your browser settings. We honor both signals, and we treat them exactly like the switch.

Switching analytics off stops future measurement; it does not remove a cookie already on your device. To delete those, clear your browser's site data for thesportstack.io. The flag is stored per browser, so set it on each device you use. It affects only whether your visits are counted; the site works exactly the same either way.

What we do not do

• We do not sell personal information, and we do not "share" it for cross-context behavioral advertising.
• We run no advertising, affiliate or marketing pixels, and the analytics is not connected to any ad product.
• We do not fingerprint your device, and nothing here follows you to another website.
• We set no age-gate cookie and no consent cookie.
• We do not store your card number. Reading the site stores nothing about you on our side at all; buying paid access stores the billing record listed in the Privacy Policy (/privacy), and nothing beyond it.

If this changes

This page is written from an inventory of what the code actually does, and it is updated before a change goes live, not after. If a login, a payment, an advertising pixel or another measurement tool is ever added, it will be described here and in the Privacy Policy (/privacy) first, and any permission the law requires will be asked for before anything is set.

Contact

Questions about this page reach a real inbox: hello@thesportstack.io. This page applies alongside our Privacy Policy (/privacy) and Terms of Service (/terms); it was last updated on September 25, 2026.