We use necessary session and security cookies for sign-in and CSRF protection. Public pages load Google Analytics only after consent and only when an administrator configures GA4; analytics never sends Player ID, kingdom, gift code, username, or URL query parameters. We currently use no advertising or marketing cookies. Gift-code account data is processed only when submitted by a user.