What sits where
| Where | Who is there | What is used |
|---|---|---|
| The site, k15.space | every visitor, players and administrators | two cookies — the session and form protection |
| The game, app.k15.space | players | the browser's storage (sessionStorage and localStorage); no cookies |
We are the only ones setting any of it. There are no third-party cookies, pixels or widgets, neither on the site nor in the game.
The site's cookies
| Name | Why | When it appears | Lifetime |
|---|---|---|---|
PHPSESSID |
the session: so that you are not asked to sign in on every page, and so that the site remembers the notice after a form is sent | when you sign in, or after you send a form | up to 30 days; signing out closes the session |
__Host-csrf-token_… |
form protection: confirms the form was sent from our page and not from somebody else's site | the moment a form is sent | until the browser is closed, and more often deleted right after sending |
The session cookie is out of reach of the page's scripts (HttpOnly), travels over HTTPS only (Secure), and comes along from another site only on an ordinary link click — not when that site calls ours in the background or submits a form to it (SameSite=Lax). The form-protection cookie travels over HTTPS only and from our own pages only (SameSite=Strict). The session cookie holds nothing but a random number the server finds your session by; the form-protection cookie, a single-use random token.
The game's browser storage
| Key | Where | Why | Lifetime |
|---|---|---|---|
universe.token |
sessionStorage | the sign-in token for the game | until the tab is closed; the token itself is valid for 30 days |
universe.lang |
sessionStorage | the interface language | until the tab is closed |
universe.build.reloadedFor |
sessionStorage | keeps a tab from reloading in circles when a new version of the game is out | until the tab is closed |
k15.graphicsQuality |
localStorage | the graphics quality you chose | until you clear the site's data in the browser |
universe.notifications.lastSeenId |
localStorage | which notification you saw last — so that old ones are not shown as new | until you clear the site's data in the browser |
None of it holds your email, your name or your date of birth. The sign-in token carries only the player's internal number and an expiry.
Why there is no banner
Consent is needed for what the site works without anyway: analytics, advertising, third-party widgets (Art. 5(3) of the ePrivacy Directive 2002/58/EC and the laws of the EU countries that implement it). Everything listed above is either strictly necessary for something you asked for yourself — signing in, sending a form, playing — or keeps a choice you made yourself: the language and the graphics quality. Entries like these need no consent.
If anything beyond that appears, this page will change first, and the site will ask for consent — with equal “Accept” and “Reject” buttons and no boxes ticked in advance.
How to delete it
Cookies and storage are cleared in the browser's settings — for k15.space and app.k15.space. The site will then forget that you signed in, and the game will forget the language and the graphics quality; nothing else is lost, since everything in the game is kept on the server.
What else we keep about you, and why, is on the privacy page. Questions go to privacy@k15.space.
Last changed on 28 September 2026.