Cookie Policy

The cookies we set

The site counts visits with Google Analytics and with our own measurement. Outside Europe and the UK they set four cookies on your device, and they are the only cookies this site sets for anyone who is not signed in:

• _ga — a randomly generated number that tells one browser apart from another, so a reader who comes back next week is not counted as a new person. It lasts up to two years unless you clear it.
• _ga_3ZBZJQ47RB — the same idea for a single visit: it tracks when your session started and how long it lasted. It also lasts up to two years unless you clear it.
• _sa_v — our own measurement's randomly generated number for this browser, so we can tell which sites and links bring readers who go on to buy a plan. It lasts 400 days from your last visit unless you clear it.
• _sa_s — the same for a single visit, so the pages of one visit are counted together. It lasts 30 minutes from your last page view.

All four are first-party cookies, set by this site on this domain; the two _sa_ cookies are set by our own server and cannot be read by any script on the page. None carries your name, your email or anything you typed, and none is used to follow you to another website. There is no advertising cookie, no affiliate tag and no social-media pixel.

The cookie you get only if you sign in

Accounts are free. The homepage, the blog, the explainers, the free games and the graded track record need none; each sport's tools and today's card need an account, and a paid plan where the site says so. If you do sign in, one more first-party cookie is set:

• tss-auth — the thing that keeps you signed in between page loads. It holds the session tokens issued to you when you signed in. If the value is long it is split across numbered cookies of the same name (tss-auth.0, tss-auth.1); that is one cookie in two pieces, not two cookies.

It is set only after you sign in, and never for a signed-out reader. It is what the EU and UK rules call strictly necessary — you asked to be signed in and it is the only way to stay signed in — so no permission is needed for it, and switching analytics off below does not affect it. Signing out removes it. So does clearing this site's data.

It is not analytics and it is not advertising. It is not read by Google, by Vercel or by anyone but this site, and it is never used to work out what you read. If you never sign in, it never exists.

A few more are set while you sign in, when you press a sign-in button and not before. tss-age-affirmed records that you ticked the age box, so the confirmation survives a trip to Google's sign-in page; tss-next remembers the page you were on, so you land back on it. Both last ten minutes at most and are deleted when you finish signing in. When a new account is created, tss-signed-up is set for at most five minutes so the next page can count the sign-up in our analytics; it holds only the sign-in method (Google, email or password) and is deleted as soon as it is read. If you start a checkout, tss-device is set: a random number for this browser, read on your next checkout so the $1 starter week is given once per device, not once per account. It lasts 400 days, holds nothing else, is never read for anything but that, and is what the EU and UK rules call strictly necessary, because it enforces the terms of an offer you chose to take. Alongside them, the sign-in library sets one or more cookies whose names start with tss-auth- and end in code-verifier: a random one-time value that proves the sign-in coming back from Google is the one this browser started. An email sign-in never needs them, so they are deleted as soon as the email is sent; a Google sign-in deletes them when it finishes. If a sign-in is abandoned half way, they can stay in your browser for up to 400 days — they hold nothing but that random value, and clearing this site's data removes them. None of these records anything else. If you sign in with Google, Google sets its own cookies on its own sign-in pages under its own policies, exactly as it would signing in to anything else — we do not control those and cannot list them.

No banner, and why

Paying is the one journey that leaves our pages — it happens on Stripe's own checkout rather than ours. See "How we measure traffic" below for where our side ends and Stripe's begins.

There is no cookie banner, and there are three reasons it is not needed rather than merely absent. First, the analytics scripts do not load at all — so no cookie is set, Google is never contacted and our own measurement records nothing — for anyone who has switched analytics off on this page or whose browser sends a Global Privacy Control or Do Not Track signal. That check runs before the scripts are requested. Second, see below: if you are reading this from Europe or the UK, no analytics cookie is set for you in the first place. Third, the only other cookie this site sets is the sign-in cookie described above, which exists solely because you asked to be signed in — the strictly-necessary category, which does not require permission.

Readers in the European Economic Area and the United Kingdom are measured without cookies. The site checks the country your request arrives from and, for those countries, starts Google Analytics in a mode that writes nothing to your device and reads nothing from it, and does not run our own measurement at all — so none of the four analytics cookies is created, and there is nothing for you to be asked to agree to. That applies to measurement; if you choose to sign in, the sign-in cookie is set wherever you are, because it is the only way to keep you signed in. The trade is on our side, not yours: we cannot tell a returning European reader from a new one, and we would rather lose that number than put something on your device without asking. If the country cannot be determined for any reason, the cookieless mode is what you get.

What the site keeps in your browser

Separately from the cookies above, a few preferences are saved in your browser's local storage so that the site remembers what you chose. These stay on your device and are never sent to us or to anyone else:

• Your light-or-dark theme choice (thesportstack-theme).
• Your NFL player-filter selections — position, team, search text and stat window — so the Usage, Projections and Props tabs share them (tss-nfl-players-filter).
• Which books you chose to chart on a player prop's line moves (tss-prop-line-books).
• Whether you chose compact or bigger rows on the props boards (tss-prop-row-density).
• The analytics opt-out flag (ss-no-track), which exists only if you switch analytics off below. It is written twice, as a stored setting and as a cookie of the same name, so that it survives in browsers that keep one but not the other — some automated and privacy-hardened browsers discard stored settings between visits. It records one thing: that you asked not to be counted.
• Two entries used by the site operator's own editing tools. They are never written for visitors.

Each of these is stored because you asked for it — the theme you picked, the filter you set — which is the "strictly necessary" category under EU and UK rules, so no permission is needed for them. That reasoning covers this list only; it does not cover the analytics cookies above, which is why the opt-out exists and why it is checked before anything loads. Clearing your browser's site data for thesportstack.io removes every item on this page, cookies included.

How we measure traffic

Two tools, both counting the same thing — whether anyone is reading the site — from different angles.

Our own measurement records, for each page view: the time, the page address without anything after the "?" (except the campaign tags described next), the referring site, any campaign tags (utm_ parameters, a ref link, or an ad click id) that brought you, your approximate country and region, your device type, browser and operating system, and the two _sa_ identifiers described above. It also records a few events that carry no personal detail: the sign-up screen being shown, a sign-in being started, a new account being created, the plans being shown, a link to a blog post being pressed, a blog post being read or read to its end, a plan or the first-week offer being pressed or picked, a question on the plans being opened, and leaving for the payment page. And it records three page-speed readings for a page load: how long the main content took to appear, how long the page took to respond to a tap or click, and how much the layout shifted. It runs on our own servers and stores this in our own database, hosted by Vercel and Supabase as our service providers; it stores no IP address. If you start a checkout, the _sa_v number is attached to the checkout we hand to Stripe, so that a subscription can be credited to the site or link that brought you. We see which sources lead to sign-ups and purchases, not who you are.

Google Analytics 4 records, for each page view: the page address and title, the referring site, the search terms or campaign that brought you if any, your approximate location (country, region, city), your device type, operating system, browser and screen size, and the _ga identifier described above so repeat visits can be recognised. Google processes this on our behalf as our service provider. Google states that it does not log or store the IP addresses of visitors to Google Analytics 4 properties; the address is used to derive the approximate location and is then discarded. We see counts and groupings, never a named person. We do not use Google Analytics for advertising, we have not enabled Google Signals, and nothing collected here is used to build advertising audiences.

Google does not keep that data forever. For this property, event-level data is retained for 14 months and user-level data for 14 months; after that Google deletes the underlying records and only aggregate reporting remains. Google Signals is off, so nothing measured here is joined to a Google account. That retention is a setting on Google's side and is separate from the cookie lifetimes listed above, which are on your device — the same 14-month figures are stated in the Privacy Policy (/privacy).

Google Analytics also receives ten counts that carry no personal detail: the sign-up screen being shown in place of a members page (with which sport), a sign-in being started (with which method), a new account being created (with whether by Google, email or password), the plans being shown (with what led you to them, and whether you were signed in), a link to a blog post being pressed (with which post, and where the link was), a blog post being read for at least 30 seconds, a blog post being read to its end (each with which post), a plan or the first-week offer being pressed or picked (with which plan, where on the site the button was, what led you to it, and whether you were signed in), a question on the plans or the Track Record link beside them being opened (with which one), and leaving for the payment page (with which plan, what led you to it, and whether it followed straight on from signing up).

One more thing sits outside all of this: paying. Where the site offers paid access, the payment is taken by Stripe, and the checkout page you enter your card on is Stripe's, not ours. Stripe sets its own cookies there and runs its own fraud-detection and security processing, under the Stripe Privacy Policy (https://stripe.com/privacy) and Stripe's cookie notice — we do not control what it sets, and we cannot list those cookies for you the way we list ours above. Our own pages load no Stripe code: you reach Stripe's checkout and billing pages by a link, and come back the same way. None of that is analytics, none of it is advertising, and the switch below does not govern it; what we receive back from Stripe is set out in the Privacy Policy (/privacy) under "Payments and Subscriptions".

Switch analytics off

One control turns off both tools. If you would rather not be counted, any of these works:

• Use the switch at the bottom of this page. It sets the ss-no-track flag in your browser. Google Analytics and our own measurement are then never loaded, so no cookie is set and no request reaches Google; our own measurement, if it is already running on the page, drops every event before it is sent.
• Open https://thesportstack.io/?ss-no-track=1 in the browser you want excluded (and ?ss-no-track=0 to undo it).
• Turn on Global Privacy Control or Do Not Track in your browser settings. We honor both signals, and we treat them exactly like the switch.

Switching analytics off stops future measurement; it does not remove a cookie already on your device. To delete those, clear your browser's site data for thesportstack.io. The flag is stored per browser, so set it on each device you use. It affects only whether your visits are counted; the site works exactly the same either way.

What we do not do

• We do not sell personal information, and we do not "share" it for cross-context behavioral advertising.
• We run no advertising, affiliate or marketing pixels, and the analytics is not connected to any ad product.
• We do not fingerprint your device, and nothing here follows you to another website.
• We set no age-gate cookie and no consent cookie.
• We do not store your card number. Reading the site stores only the visit records described above, under random numbers rather than anything that names you; buying paid access stores the billing record listed in the Privacy Policy (/privacy), and nothing beyond it.

If this changes

This page is written from an inventory of what the code actually does, and it is updated before a change goes live, not after. If a login, a payment, an advertising pixel or another measurement tool is ever added, it will be described here and in the Privacy Policy (/privacy) first, and any permission the law requires will be asked for before anything is set.

Contact

Questions about this page reach a real inbox: hello@thesportstack.io. This page applies alongside our Privacy Policy (/privacy) and Terms of Service (/terms); it was last updated on November 9, 2026.