Cookies and local storage

Updated 9 September 2026 · 2026-09-09-WP2R1

This release does not add advertising or optional analytics trackers. The account service still needs some technical storage to sign you in, protect forms and remember settings.

Account sign-in

devd2_session

is a Secure, HttpOnly, SameSite=Lax cookie used by the account website. It normally lasts 30 days and can expire sooner if revoked; the session duration is configurable. Browser JavaScript cannot read this HttpOnly cookie.

Blocking it prevents the site from keeping you signed in. Clearing the cookie removes it from that browser but is not the same as deleting your account or its server-side session record.

Cloudflare and Turnstile

Cloudflare and the Turnstile widget process technical information to protect forms and traffic. Security storage may depend on the active Cloudflare configuration. A clearance cookie may be used where pre-clearance is enabled; the Turnstile setup for this release does not require enabling pre-clearance.

See

Cloudflare’s privacy information (https://www.cloudflare.com/privacypolicy/)

. Do not disable security validation as a substitute for fixing a sign-in problem.

Local preferences

The supplied static guide does not set its own cookies or use browser localStorage; filter selections use page memory and URL query parameters. The Windows launcher stores its installation configuration and preferences locally, and protects its sign-in credential using Windows facilities. Choosing to save account preferences can also send those settings to DevD2, as explained in the privacy notice.

You can clear website storage in your browser settings. This may reset filters or sign you out; it does not erase realm characters or shared-stash contents.

Following the Discord link

Our Discord contact is an ordinary external link, not an embedded Discord chat widget. If you follow it, Discord’s own privacy policy applies to its platform.