Cookie Policy
What cookies and browser storage we use. Cookies only to keep you signed in; storage only to remember your interface. No analytics. No tracking.
Cookie Policy
Effective date: 2026-09-17
Version: 2026-09-17
Plain English: We use only the cookies needed to keep you logged in safely. No analytics. No advertising. No third-party tracking.
1. What This Policy Covers
This Cookie Policy describes the cookies, local storage, and similar tracking technologies used by Market Sniper. It supplements the Privacy Policy.
2. What Is a Cookie?
A cookie is a small text file placed on your device by a website. Cookies allow the website to remember information about your visit, like your sign-in state. Local storage is a similar mechanism with larger capacity and no automatic transmission to the server.
3. Cookies We Set
3.1 Strictly Necessary Cookies
These cookies are required for the Service to function. You cannot opt out of strictly necessary cookies and continue to use the Service.
| Cookie name | Purpose | Lifetime | Scope |
|---|---|---|---|
Session cookie (SESSION_COOKIE_NAME per backend config) | Authenticates your active session. HttpOnly, Secure (in production), SameSite=Lax | Per SESSION_TTL_SECONDS configuration; deleted on logout | First-party |
Anonymous CSRF cookie (ANON_CSRF_COOKIE_NAME per backend config) | Cross-site request forgery protection for unauthenticated requests (signup, login). SameSite=Lax | Set during pre-auth flow; removed after authenticated session established | First-party |
Trusted-device cookie (msniper_td) | Remembers that this browser already completed two-factor authentication, so you are not challenged on every sign-in. Holds a random device identifier only — no account data. HttpOnly, Secure (in production), SameSite=Lax | Up to 365 days. Signing out does not forget this device: a later sign-in from this browser still skips the two-factor challenge, and renews the trust period you chose (a day, a week, a month, or a year). To end it sooner, revoke the device under Account → Security, or turn off two-factor. | First-party |
Corrected 2026-09-13. An earlier version of this table said the trusted-device cookie was cleared when you sign out. That was never true. Signing out has always left a remembered device trusted until its trust period ends. If you signed out of a shared or borrowed computer where you had chosen to remember the device, revoke that device under Account → Security.
3.2 First-Party Browser Storage (Functional)
We use your browser's local storage, and in two cases its session storage, to remember how you use the interface. These are not cookies. Except where the table below says otherwise, an entry never leaves your browser: we cannot see it, and only our own pages, running in your browser, read it. Three entries do send something, and one entry's name includes your account number; the table marks all four. Clearing your browser storage removes every entry, and costs you only what each one remembers.
A part of a name in angle brackets, such as <game>, stands for a value filled in when the entry is
written, like the game you are viewing.
| Entry | What it remembers | How long | Leaves your browser? |
|---|---|---|---|
sniper.sidebar.collapsed | Whether the sidebar is collapsed | Until you clear browser storage | No |
sniper.sidebar.gamenav.collapsed | Which game menus in the sidebar you opened or closed | Until you clear browser storage | No |
market-sniper.backdrop-override | The page background you chose on this device (animated or plain grid) | Until you clear browser storage | No |
market-sniper.backdrop-struggled | That this device could not play the animated background smoothly, and when that was noticed | Ignored after 7 days and then removed, so the device is tried again | No |
market-sniper.backdrop-notice-seen | That you have seen the notice about switching to the plain background | Until you clear browser storage | No |
market-sniper:recent-item-searches | Your last six item searches, so the search box can offer them again | Until you clear browser storage | No |
market-sniper:practice:fills-watermark:<game> | The time of the newest Practice fill you saw on that game's floor, so the tape can show what is new since your last visit | Until you clear browser storage | No |
market-sniper:practice:fills-watermark | The same time, from an older version that kept one for every game. It is still read, so an older browser keeps its place; nothing writes it any more | Until you clear browser storage | No |
market-sniper:practice:item-names | The names of up to 200 items you have seen in Practice, so orders show a name rather than an item number | Until you clear browser storage | No |
market-sniper.academy-progress | The Academy lessons you marked as read on this device, and the last lesson you opened | Until you clear browser storage | Yes, once. After you sign in, the lessons it lists and your last lesson are copied to your account, so your progress follows you to other devices |
market-sniper.ai-dock-window | Where you placed the AI chat window on this device and how big you made it: docked, moved, or snapped to a side or corner (Pro+) | Until you clear browser storage, or choose Reset size in the window's menu | No |
market-sniper.ai-dock-session | Whether the AI chat window was open or minimized in this tab, which conversation was open, and which replies you have not seen yet, by number (Pro+). Kept in session storage | Until you close the tab | Yes. After a reload, the conversation's number is sent to us to reopen it, and the numbers of the conversations with replies you have not seen are checked against your own list of conversations |
market-sniper.read-grade-marks | Which AI replies you marked on this device, what the mark was, and the mark's id (Pro+) | Until you clear browser storage | Only when you undo a mark. The mark itself reaches us when you make it (Privacy Policy §10.1); this entry only remembers it here. If you undo a mark after reloading the page, its id is sent with the undo |
ms:data-depth-ack:<game> | That you acknowledged the notice about how much market history that game's data source provides | Until you clear browser storage | No |
mp_markets_idx_p1_welcomed_v1 | That you dismissed the Markets welcome banner, and when | Until you clear browser storage | No |
sniper.onboarding.<game>.seen | That you have seen the first-visit welcome for that game | Until you clear browser storage | No |
market_sniper:onboarding:proplus_alerts_v1:<account number> | That you dismissed the Pro+ alerts hint on the Notifications page. The entry's name includes your account number, so the hint stays dismissed for your account and not for anyone else who signs in on this browser. It is readable only on this device | Until you clear browser storage | No |
ms_beta_welcome_seen_v1 | That the beta welcome has already been shown in this browser tab. Kept in session storage | Until you close the tab | No |
market-sniper.chart-perf | Whether the optional chart-performance readout is on. The app only reads it; it is switched on by hand from the browser's developer console | Until you clear browser storage | No |
sniper:operator:sidebar:collapsed | Staff tools only: whether the operator sidebar is collapsed | Until you clear browser storage | No |
sniper:operator:saved-filters:v1:<page> | Staff tools only: filter sets saved on an operator page | Until you clear browser storage | No |
Entries we removed. The Alching and Death's Coffer setup pages used to save your fire provider
(market-sniper:alching-fire-provider) and a capital figure you typed
(market-sniper:deaths-coffer-capital). Nothing ever read them back, and those pages no longer save
them; they keep your setup in the page address only. If an older version saved one in your browser,
it is deleted the next time you open any market page, such as Alching or Death's Coffer. The saved
copies were never sent to us.
Added 2026-09-17 (version 2026-09-17). Two entries were added for the AI chat window:
market-sniper.ai-dock-window, which remembers where you put the window on this device, and
market-sniper.ai-dock-session, which remembers the window's state in the current tab. The second
is the third entry that sends something, and the second kept in session storage.
Corrected 2026-09-14 (version 2026-09-14.2). The previous version said these entries "are never transmitted to our servers, and none of them identifies you". Both statements were wrong. Academy progress is copied to your account after you sign in, and the Pro+ alerts hint entry carries your account number in its name. That version also described the entries by category, and the categories left out Practice desk memory, AI reply marks, Academy progress and the staff-tool entries. This section now names every entry, and an automated check on our side fails whenever the app stores an entry this table does not name.
Corrected 2026-08-05. An earlier version of this section listed two storage keys. Neither existed — they were source file names — and every key we actually used was missing.
Corrected 2026-09-14. The version before this one gave "a capital figure you typed" and "a selected provider" as examples of desk settings we keep. Those are the two removed entries above.
3.3 Cookies / Storage We Do NOT Use
We affirmatively do not use:
- Analytics cookies — no Google Analytics, no Mixpanel, no Segment, no Amplitude, no PostHog, no Plausible, no Fathom, no other analytics SDK.
- Advertising cookies — no Google Ads, no Meta Pixel, no LinkedIn Insight Tag, no Twitter Pixel, no other advertising-network beacon.
- Social-media tracking — no Facebook Connect, no Twitter widget, no LinkedIn share, no Instagram embed.
- Cross-origin tracking — no third-party scripts loaded from external domains, and no tracking pixels.
- Behavioral profiling — we do not build profiles of your behavior across sessions or sites.
Images from other sites. Some pages show pictures that your browser loads directly from other
sites: item and skill icons from the RuneScape wikis (oldschool.runescape.wiki and
runescape.wiki), and the Discord logo from cdn.simpleicons.org. We do not copy these images onto
our own servers. Loading one is an ordinary web request, so that site sees your IP address, which
browser you use and when, as it would if you visited it. We ask your browser not to tell it which of
our pages you were on. We receive nothing back from these requests. What those sites do with a
request, including any cookie they set, is covered by their own policies.
If we ever add a non-strictly-necessary cookie or third-party tracker, we will:
- update this Cookie Policy and treat the change as material under the Privacy Policy version-update gate;
- deploy a cookie-consent banner that captures your opt-in or opt-out (where required by law) before any non-strictly-necessary cookie is set;
- notify you by in-app notice and email.
4. Third-Party Cookies
We do not currently set any third-party cookies. The sites that serve the images described in §3.3 receive your browser's request for each image; if one of them sets a cookie on that request, the cookie is theirs, and your browser's third-party cookie setting applies to it. If we activate the Stripe payment processor in the future, Stripe will set its own cookies on its hosted checkout pages — those cookies are governed by Stripe's privacy policy, not ours.
5. Browser Controls
You can control cookies through your browser settings:
- Block all cookies — will break the Service (you cannot stay logged in without our session cookie).
- Block third-party cookies — has no effect on the Service today (we do not set third-party cookies).
- Clear cookies on close — will log you out at the end of each browser session.
Most browsers also support "Do Not Track" signals. Because we do not engage in cross-site tracking, DNT signals are effectively no-ops for us — we behave the same whether DNT is on or off.
6. Mobile and Other Devices
The Service is a web application. We do not currently distribute a mobile application. Browser cookies on mobile devices behave the same way as on desktop devices.
7. Changes
We may update this Cookie Policy from time to time. Material changes (such as the addition of any non-strictly-necessary cookie) will be communicated by in-app notice plus email and will trigger a cookie-consent flow before the new cookie is set.
8. Contact
Questions about this Cookie Policy: [email protected]
Last updated: 2026-09-14