| Cookie | Purpose | Access | Lifetime |
|---|---|---|---|
| matcha_session | Keeps you signed in. It contains a signed, opaque session identifier; the Discord access token stays encrypted on the server. | Server only (HttpOnly) | Up to 7 days; the session also expires after 12 hours without use |
| matcha_csrf | Stops another website submitting dashboard changes as you. The dashboard must echo this random value with write requests. | Dashboard and server | Up to 7 days, or until you sign out |
| matcha_oauth_state | Links the start and finish of Discord sign-in and prevents forged sign-in callbacks. | Server only (HttpOnly) | 10 minutes |
Cookie Policy
Last updated
Matcha uses only the cookies needed to sign you in and protect dashboard requests. It does not use advertising, analytics or cross-site tracking cookies.
Cookies used by Matcha
Why there is no cookie banner
These cookies are strictly necessary to provide the dashboard and protect it from abuse. They are not used to measure visitors, build a profile, advertise or follow you across websites. Because Matcha does not set optional cookies, there is no optional-cookie choice to ask you to make.
Your controls
Signing out clears Matcha's cookies and immediately revokes the server-side session. You can also delete cookies in your browser. Blocking them will leave the public pages working, but the dashboard cannot sign you in or safely save changes.
Other services
Choosing “Continue with Discord” takes you to Discord. Discord is a separate service and may use its own cookies under its own policy. Matcha does not read those cookies.
Questions and changes
Questions can be sent to matcha@feksake.com. Material changes will be described here and reflected in the date at the top of this page.