Cookie Policy
Last updated: 18 September 2026
1. What cookies are
Cookies are small text files a website stores on your device to remember things between page loads - like keeping you signed in. This page lists every cookie and browser-storage item playyourway.com.au uses, run by PLAYYOURWAYHOSTING (ABN 33 985 231 059). The short version: essential cookies always, plus two things you have to switch on yourself - a referral cookie, and product analytics with session replay. There are no ad-network cookies and no social-media pixels: one first-party cookie of our own remembers which of our adverts brought you here, and nothing here follows you to other websites.
2. Your consent
Non-essential storage is opt-in: the cookie banner asks before anything optional is stored, “Essential only” is always offered as prominently as “Accept all”, and you can change your mind at any time - withdrawing consent deletes the optional cookies immediately. There are two optional categories and they are separate switches, so saying yes to one is not saying yes to the other. Use the button below, or the “Cookie settings” link in the footer of any page.
On 6 September 2026 we added the analytics category. Every choice made before that date was retired and the banner asked again. An older “Accept all” was deliberately not carried over: at the time it was given, this site ran no analytics at all and the banner said so, and treating that as permission for something which did not yet exist would not be consent to anything.
We keep a record of each choice so we can show it was actually made: a random identifier (the same one in your own pyw_consent cookie, so you can match it), what you allowed, the version of this notice, and when. No IP address, no device or browser details - see Privacy Policy.
3. Essential cookies
These keep the site working - sign-in, checkout security, chat continuity and your consent choice itself. They cannot be switched off, because the service does not function without them.
| Cookie | Purpose | Duration | Opting out |
|---|---|---|---|
| sb-*-auth-token | Your sign-in session (Supabase authentication). Split into numbered chunks when large. | Up to 12 months; refreshed while you use the site | Required to stay signed in - sign out to remove it |
| pyw_consent | Stores your cookie-consent choice so we don't ask again. | 12 months | Delete site cookies to be asked again |
| pyw_attr | Remembers which of our own adverts or links first brought you here: the campaign labels in the address you arrived on, the page you landed on and the website that sent you. Set by us, holds no identifier, and nothing is sent to any advertising network - we use it only to tell whether our advertising works. | 30 days from your first visit | Strictly necessary for measuring our own advertising; contains nothing that identifies you. Delete site cookies to clear it |
| pyw_dpf_state / pyw_dpf_return | Security (CSRF) state for the optional “prefill from Discord” flow on login/signup. | 10 minutes; deleted when the flow completes | Only set if you use the Discord prefill button |
| pyw_prefill_email | Carries your email to the login form after Discord prefill, then is cleared. | 2 minutes | Only set if you use the Discord prefill button |
| guest_chat_session | Keeps a guest live-chat conversation attached to you between page loads. | 30 days | Only set if you start a live chat while signed out |
| __stripe_mid / __stripe_sid | Stripe's card-fraud prevention on our checkout pages (set by Stripe, a third party). | 1 year / 30 minutes | Only load on cart/checkout pages; required to pay securely |
| __cf_bm | Cloudflare bot protection in front of the site (set by Cloudflare, a third party). | About 30 minutes | Required for the site's DDoS/bot protection |
4. Optional cookies
Two categories, and neither is stored without your consent. Analytics is the bigger of the two, so it has a section of its own below.
One thing this page cannot cover, mentioned here so it is not a surprise: we also count page views using Cloudflare Web Analytics, which sets no cookie and stores nothing on your device at all. It tells us how many people visited a page, not who. Because it stores nothing, it is not a cookie and has no row in these tables - it is described in section 5 of our Privacy Policy instead.
| Cookie | Purpose | Duration | Opting out |
|---|---|---|---|
| pyw_ref | Referral attribution - remembers which partner referred you so they earn a commission if you subscribe. | 30 days from the referral click | Only set with your consent; withdraw below and it is deleted immediately |
| ph_phc_*_posthog | Product analytics and session replay (set by PostHog, a third party). Holds a random visitor id, a device id and the current session id, so separate page views can be read as one visit. Stored in both a cookie and local storage. | 12 months, refreshed each time you visit | Only set if you switch analytics on; switch it off below and it is deleted immediately |
| ph_phc_* (session storage) | Four short-lived entries that keep one browser tab apart from another, so a replay is not stitched together out of order: a per-tab id, a copy of the current session state, a marker for which tab is the primary one, and the properties attached to this session. Session storage, not cookies. | Until you close the tab | Same switch as above |
5. Session replay, in plain terms
If you switch analytics on, PostHog also records a replay of your visit: which pages you moved through, where you clicked and scrolled, and how the interface responded. It is a reconstruction built from those events rather than a video of your screen, and it gives us no access to your device, your files, or anything outside this website. We use it for two things: seeing where the site confuses people, so we can fix it, and working out what went wrong when you ask us for help.
Be clear about what that covers. It is not only the marketing pages - it includes your signed-in dashboard and your server panel, so a replay can show your server list, your console and the pages you moved through as they appeared on screen, and we can watch those replays. Replay is switched off entirely in our staff admin area.
Be equally clear about what is recorded, and what is not. What you type is recorded as you typed it, with one exception: passwords. Anything entered into a password field is replaced with asterisks in your browser before it is sent, so a password never leaves your device in a recording. The passwords the panel can show you on request, such as your SFTP, database and join passwords, are hidden the same way, and two-factor setup is left out of recordings entirely. Card details are handled inside Stripe’s own frames, which are not recorded at all, and your billing pages are masked in full, so your address, the last four digits of your card and every amount are hidden while the layout still shows. Everything else is recorded as it appeared to you: your account details, your server console, the file manager, database and SFTP screens, startup variables, support tickets and live chat. Your console can include lines about the players on your server. We do not record the contents of network requests or responses, but we do record the messages your browser writes to its developer console, because they often explain an error you never saw.
Replays are stored by PostHog on servers in Frankfurt, Germany, and are deleted after 30 days. Switching analytics off stops any new replay being recorded straight away and deletes the cookies above. If you want the replays we already hold deleted as well, email support@playyourway.com.au and we will delete them.
6. Third parties
Three third parties can store something through this site. Two are strictly necessary and always on: Stripe (checkout fraud prevention - see Stripe’s privacy policy) and Cloudflare (bot/DDoS protection - see Cloudflare’s privacy policy). The third is PostHog, our analytics and session-replay provider, and it only runs if you switch analytics on (see PostHog’s privacy policy). PostHog processes our analytics data in the European Union. There are still no advertising networks and no social-media pixels on this site.
7. Browser storage that isn’t a cookie
We also use your browser’s local storage. Most of it is device-side preference that never leaves your browser:
- Appearance and accessibility - theme, contrast, text size and reduced-motion choices.
- Cart - the contents of your cart and its selected billing cycle.
- Remembered login email - only if you tick “remember me” on the login page (30 days).
- Interface state - things like collapsed sidebars and “you’ve seen this tour” flags.
- Offline shell cache - a service worker caches the site shell so pages load faster.
- Analytics, only if you switched it on - PostHog keeps its visitor id and session id in local storage alongside the cookie in the table above, plus four short-lived per-tab entries in session storage. This is the one item here that does leave your browser. Switching analytics off removes all of it.
Clearing your browser’s site data removes all of it. Push notifications are separate and strictly opt-in: if you enable them in your dashboard, your browser’s push service (Google, Mozilla or Apple, depending on your browser) delivers them; disabling them in your account or browser removes the subscription.
8. Managing cookies in your browser
Beyond our banner, every browser lets you view, block and delete cookies: Chrome, Firefox, Safari, Edge. Blocking essential cookies will break sign-in and checkout.
9. Do Not Track and Global Privacy Control
There is still no agreed standard behind the Do Not Track header, so we do not act on it. Global Privacy Control is different: it is a deliberate, machine-readable “no”, and several privacy laws treat it as one. If your browser sends it, we take it as a refusal of analytics - the analytics switch starts off, PostHog is never loaded, and no replay is recorded. You can still turn it on yourself afterwards if you want to.
10. Changes and contact
If our cookies change, this page and its “Last updated” date change with it, and a material change re-opens the consent banner. Adding a new optional category always retires every earlier choice, so you get asked again rather than being opted in by something you agreed to before it existed. Questions: support@playyourway.com.au. See also our Privacy Policy.
Questions about cookies?
Ask us anything on this page and we'll explain it in plain English.