Cookie policy
Coinsprout sets two cookies, both essential, both ours. No advertising cookies, no analytics cookies, no third-party trackers. Effective January 15, 2026.
Exactly two
- Essential
coinsprout_session
Keeps you logged in to your parent account between pages. HTTP-only and same-site, so scripts cannot read it and other sites cannot send it.
Lifetime: 30 days, or until you log out
- Essential
coinsprout_csrf
A random token that pairs with each form you submit so that another website cannot submit a form as you. HTTP-only and same-site.
Lifetime: Session, cleared when the browser closes
How this works
Why we do not ask you to accept cookies
Cookie banners exist to collect consent for cookies that are not strictly necessary, such as advertising and analytics cookies. Coinsprout sets only cookies that are strictly necessary to run the service you asked for: one to keep you logged in and one to protect forms from forgery. Those do not require consent under US state privacy laws or the European rules that inspired most banners, so we do not show one. Visiting the marketing pages without logging in sets no cookies at all.
What the cookies do not do
- They do not track you across other websites. They are same-site cookies and are only sent to coinsprout.tech.
- They do not contain personal information. The session cookie holds a random identifier that maps to your login on our server; the CSRF cookie holds a random token.
- They are not readable by JavaScript, including any script on our own pages, because they are HTTP-only.
- They are not shared with or set by any third party. Stripe's checkout, when you upgrade, runs on Stripe's own pages under Stripe's own policy.
Local storage
Child mode remembers a few harmless preferences in your browser's local storage, such as whether the sound is on and which world was played last, so a kid does not have to set them again. Local storage never leaves your device and contains nothing personal. Clearing your browser data removes it.
How to clear or block cookies
Logging out deletes the session cookie immediately. You can also clear cookies in your browser settings; in most browsers this is under Privacy or Site data, where you can remove cookies for coinsprout.tech alone. If you block cookies entirely, the marketing pages will still work, but you will not be able to log in to a parent account, because the session cookie is how we know it is you.
Changes
If we ever add a cookie, we will list it here, explain what it is for, and, if it is not strictly necessary, ask for your consent before setting it. Questions go to privacy@coinsprout.tech.