Last updated: August 22, 2026.
This Cookie Policy explains how Pentito uses cookies and similar technologies on pentito.game, its game pages and related web services. It should be read together with our Privacy Policy.
Some technologies listed below are only used on particular pages, after a security challenge, when a feature is enabled, or when you have given the relevant consent. The exact cookie name may contain a service or measurement identifier.
Cookies are small text files stored by your browser. Session cookies normally expire when the session ends; persistent cookies remain until their stated expiry date or until you delete them.
We also use similar technologies such as local storage, session storage, pixels, tags, scripts and device or security signals. These technologies can remember settings, maintain a secure session, measure use, diagnose errors or attribute a visit or registration to a campaign.
Where consent is required by applicable law, preference, statistics and marketing technologies are used on the basis of your consent. Strictly necessary storage is used because it is required to provide or secure the service. Related processing of personal data is based on the legal grounds described in our Privacy Policy.
| Cookie | Category and purpose | Typical duration |
|---|---|---|
PHPSESSID or another Pentito session name | Strictly necessary. Authenticates and maintains your session, including secure sign-in flows. | Up to 48 hours; the identifier may be renewed for security. |
pentito_ajax_token | Strictly necessary. Protects same-site requests against cross-site request forgery and keeps request validation working. | Session. |
pentito_cookie_consent | Strictly necessary. Records the cookie categories you accepted or rejected and the time of your choice. | Up to 12 months. A temporary dismissal may be remembered for up to 30 days. |
zaraz-consent | Strictly necessary. Stores the same consent choices for Cloudflare Zaraz so optional statistics and marketing tools remain blocked or enabled according to your selection. | Configuration dependent, no longer than needed to remember the current consent choice. |
outgame_rt_v1 | Marketing/attribution. Stores the first landing page, campaign parameters and referring source so a later registration can be attributed. | 7 days. |
Pentito may create additional short-lived, strictly necessary values when you sign in, complete a security check, use the mobile app or access a protected feature. Their purpose is authentication, fraud prevention, continuity or security rather than advertising.
Where account-linked cookie controls are enabled, when you make an explicit cookie choice and later register or sign in, Pentito may associate that choice, its policy version and the time of the choice with your master account. This allows the newest choice to be applied consistently to signed-in game pages and future signed-in sessions, including on another device. Merely dismissing the banner is not stored as account consent.
Depending on the page, configuration and your choices, Pentito may use the following services:
_ga and _ga_*. When delivered through Cloudflare Zaraz, first-party state may also use zaraz_google-analytics_v4 and zarazs_google-analytics_v4. They commonly last from the session up to 2 years, although our configuration or your browser may shorten this._clck (commonly up to 1 year) and _clsk (commonly about 1 day).Statistics technologies are only categorized as strictly necessary where a specific diagnostic is genuinely required to deliver or secure a requested feature; otherwise they belong to the statistics category.
_fbp and, after an ad click, _fbc, typically for up to 90 days. When delivered through Cloudflare Zaraz, first-party state may also use zaraz_facebook-pixel and zarazs_facebook-pixel._rdt_uuid, commonly for up to 90 days.outgame_rt_v1 cookie may record UTM parameters, advertising click identifiers, the first visited path and the referring website for up to 7 days.These services may link information about your visit with information already held by the provider. We do not sell personal data. Advertising providers act under their own terms and privacy information for the processing they perform as independent controllers.
cf_clearance, __cf_bm or _cfuvid. Their duration varies from a short session or about 30 minutes to the period required to remember a completed challenge.Security services may operate without optional consent where their storage or processing is strictly necessary to protect the requested service. Providers must not use that exception for unrelated advertising purposes.
When you choose to use a particular feature, additional providers may set or read cookies or similar storage on their own domains:
youtube-nocookie.com domain.These providers determine the duration of cookies on their own domains. Consult the relevant provider's privacy and cookie information for the latest details.
You can accept all optional categories, reject them, or choose categories in the cookie preference controls when those controls are displayed. Rejecting optional cookies must not prevent access to the core game.
You can withdraw consent at any time by reopening the cookie preference controls where available and saving a new choice. If your choice has been associated with a master account, the newest explicit choice is also stored on that account and used for signed-in pages; deleting only the browser cookie does not by itself remove that account-level choice. You can also block or delete cookies in your browser settings. Withdrawal does not affect processing that lawfully occurred before withdrawal.
If you block strictly necessary cookies, sign-in, security checks, payments or other core functionality may stop working. Browser-level blocking may not remove information already received by a third party, so you may also need to use that provider's opt-out or privacy controls.
Some providers may process data outside the European Economic Area. Where required, Pentito relies on an adequacy decision, the European Commission's standard contractual clauses or another lawful transfer mechanism. See our Privacy Policy for more information about providers, retention and your data protection rights.
The durations above are typical maximums and can be shortened by our configuration, your browser, provider changes or earlier deletion. We periodically review this inventory and update it when the technologies used by Pentito materially change.
Some browsers send Do Not Track or Global Privacy Control signals. Where a signal is legally binding, we will honour it as required by applicable law. Otherwise, use the cookie preference controls or browser settings to communicate your choice.
The Pentito mobile applications may use secure app storage, device identifiers, push-notification tokens and embedded web storage for equivalent operational, security, preference, analytics or attribution purposes. Mobile operating-system privacy settings may provide additional controls.
We may update this policy when our website, game, providers or legal obligations change. The date at the top shows the latest revision. Material changes to optional tracking may require us to request your consent again.
For questions about cookies or the processing of personal data, contact [email protected]. You can also read our Privacy Policy or submit an Account Deletion Request.
We use cookies to keep the site working and to improve your experience. Cookie Policy