Cookie policy
Two cookies max: a consent cookie for everyone, and a sign-in session cookie on the API host if — and only if — you have an account. We write the details anyway, for SEO.
1. What is a cookie
A cookie is a small text file a website stores in your browser. Most sites use them for tracking. We think that's gross.
2. The cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
thtb-cookie-consent | Remembers your consent choice so the banner doesn't nag you every visit. | 365 days |
__Host-thtb_sid | Sign-in session, set by the backend on the API host only if you create or sign in to an account. HttpOnly, Secure, revoked on sign-out or account erase. | 30 days |
The session cookie is set on the backend API host (currently thtb-backend.tpoisa1.workers.dev, flagcheck.tryhackthisbitch.com once the domain is wired), not on the main site. No scripts can read it — it's HttpOnly — and it only exists while you're signed in.
3. Cookies we do NOT set
- No advertising / targeting cookies.
- No analytics cookies (no Google, no third-party analytics at all).
- No third-party cookies from embedded trackers, embeds, or widgets.
4. Local storage is not a cookie
Your progress, streaks, survey, and generated challenges are kept in the browser's local storage — a separate, site-scoped storage area that never leaves your device. Local storage doesn't expire, so it's a great place to keep your streak. Cookies require consent; local storage doesn't, and we use it. The privacy policy lists every key we use.
5. Managing & deleting
- Withdraw consent: click the "manage cookies" link in the site footer (see below) or clear the consent cookie via DevTools → Application → Cookies → delete
thtb-cookie-consent. - Delete everything: browser settings → site data → remove this site's data (currently under
tryhackthisbitch.pages.dev,tryhackthisbitch.comonce the domain is live). This clears the cookie, all local storage, and therefore your progress. - Block all cookies: the site still works. You'll just re-see the consent banner.
6. Consent control
This button deletes the thtb-cookie-consent cookie and the banner will return on your next visit.
7. Updates
No tracking ever gets added without updating this page first and re-asking for consent. Last updated: September 2026.