Cookies and browser storage
Last updated: October 10, 2026. Required storage supports app features. Optional PostHog analytics uses memory for its analytics identifiers and runs only after you allow it. We do not use advertising cookies.
| Storage | Purpose | Duration |
|---|---|---|
__Secure-dc20.session_token cookie | Authenticates your account. Unavailable to ordinary page JavaScript; sent securely over HTTPS. | Email sign-up, password sign-in with Remember this device, and Google, Discord or passkey sign-in: 30-day cookie, renewed for another 30 days at most once a day while you use the app. Password sign-in without Remember this device: a browser-session cookie that ends when you close the browser; the server ends that sign-in after 1 day either way. Signing out, signing out a device in Account settings, or server expiry ends access even if a cookie remains. |
__Secure-dc20.dont_remember cookie | Records that you did not choose Remember this device, so that sign-in is not renewed. | Until the browser session ends or you sign out. |
Short-lived sign-in cookies: __Secure-dc20.state (Google or Discord sign-in), __Secure-dc20.better-auth-passkey (passkey sign-in or setup), __Secure-dc20.two_factor (two-factor code step) | Tie each sign-in step to the browser that started it, to block forged sign-in attempts. Unavailable to ordinary page JavaScript. | 5 minutes (Google, Discord and passkey) or 10 minutes (two-factor), or until that step finishes. |
__Secure-dc20.trust_device cookie | Set only if you choose Trust this device for 30 days at the two-factor step; lets this browser skip the code. | 30 days from the last sign-in that used it. |
| Account/guest character, homebrew and pending-edit browser storage | Saves your game locally, supports offline access, and retries unsynced edits. | Until cleared by you or the app's applicable deletion controls. Signing out locks access in the app but does not erase saved copies. |
| Preferences, onboarding and account-change browser storage | Remembers requested settings and prevents mixing accounts. | Until cleared or replaced. |
| Tab/session storage | Restores your place within the app. | Usually until the browser tab/session ends, subject to browser restoration behavior. |
| Optional self-hosted cloud-sync token | Authenticates a separately configured, cross-origin self-hosted installation. The ordinary hosted site uses the cookie above. | Until logout, clearing storage or replacement; the server can expire or revoke access sooner. |
| Signup age-screen flag (session storage) | Prevents retrying signup after an under-13 answer in that tab; no birthday is stored. | Until that browser tab session ends; browser session restore may preserve it. |
Your controls
You can clear this site's cookies and storage through your browser's site-data settings. Export any characters and unsynced edits you want to keep first. Clearing cookies signs you out; clearing local storage can permanently remove guest characters and unsynced edits. It does not delete your cloud account. To request account deletion, use the contact in our privacy notice.
Hosting and external resources
Cloudflare delivers and protects this website. Security challenges, if enabled, may use additional security cookies. Fonts and required libraries are served from our own site. External links or resources you choose can still transmit connection information to their destinations. We do not label every cookie from a hosting provider automatically essential; optional features must be reviewed before being enabled.
Optional analytics
You can choose to help improve DC20 Sidekick by allowing PostHog usage analytics. This records page categories and actions such as creating characters, exporting sheets, and joining campaigns. A signed-in account may be associated using its internal account ID. We do not send email addresses, usernames, character contents, URLs with verification or share tokens, session recordings, or console logs through this integration. PostHog receives connection information when analytics requests reach its US service. Analytics is off until you allow it, and rejecting it does not affect game or account features. We honor Do Not Track and Global Privacy Control.
Your choice is saved in dc20forge.analyticsConsent.v1 for up to 180 days. Analytics identifiers remain in memory for the current page. You can withdraw consent here at any time; this stops future collection but does not remove previously submitted events. Contact us through the privacy notice for a data request.
Optional analytics is off on this browser.
Cloudflare Turnstile runs on signup and password recovery to prevent automated abuse. It processes browser and connection information and produces a temporary verification token. We do not use it for advertising or audience analytics.