Cookie Policy

2. Scope and related policies

This Policy applies to shop.hfi.gg. It should be read together with the Privacy Policy, Terms of Service, Refunds Policy, and any checkout disclosures shown when you buy Shards, supporter subscriptions, donations, or in-game products.

This Policy does not govern cookies used by Discord, Stripe, ARK: Survival Ascended, platform stores, browser extensions, operating systems, or other third-party services. Those services control their own cookies and browser technologies.

3. What cookies and similar technologies are

Cookies are small files or values stored by your browser. Similar technologies can include local storage, session storage, server-side sessions tied to a browser cookie, request logs, anti-forgery values, and OAuth state parameters. These technologies help a website remember that the same browser made related requests.

HFi Shop primarily uses a server-side session model: the browser stores a session identifier, while sensitive account, order, checkout, and fulfillment information stays on HFi-controlled servers or trusted third-party payment systems.

4. Strictly necessary shop cookies

HFi Shop uses strictly necessary cookies and server-side session records to:

• Keep you signed in after Discord OAuth completes.
• Remember safe return paths during login and checkout flows.
• Protect against login-state confusion, forged requests, duplicate checkout actions, and unauthorized admin access.
• Show account-specific information such as linked ARK identity status, Shard balance, order history, delivery status, supporter status, and billing-portal access.
• Connect checkout, refund, dispute, and fulfillment records to the correct signed-in Discord account and linked ARK identity.

The default shop session cookie is separate from the main hfi.gg site cookie. The exact cookie name, flags, and lifetime may change as the shop deployment is hardened, but HFi intends to use secure, HTTP-only session cookies where practical.

5. Discord login and Stripe checkout cookies

When you log in with Discord, HFi Shop uses temporary state values and a shop session to complete the OAuth flow and return you to the expected page. Discord may set or read its own cookies when you visit Discord-controlled login pages.

When you start a Stripe checkout, billing portal session, supporter subscription, donation checkout, or refund-related payment flow, Stripe may set or read cookies on Stripe-controlled pages. HFi does not receive your full card number from Stripe Checkout.

6. Third-party cookies and embedded services

HFi Shop may link to or redirect you to third-party services, including Discord, Stripe, ARK-related services, and the official HFi Discord community. Those services may use cookies, device identifiers, fraud-prevention tools, analytics, or other browser technologies under their own policies.

HFi is not responsible for how third parties use cookies on their own domains. Review the third-party policy before using that service if you have questions about its cookie or privacy practices.

7. Analytics, advertising, and preference cookies

HFi Shop does not currently use advertising cookies, cross-site behavioral advertising pixels, or third-party marketing analytics cookies. If HFi adds analytics, ad measurement, heatmaps, embedded media, customer support widgets, or preference storage later, this Policy should be updated before or when those tools go live.

HFi may use ordinary server logs, reverse-proxy logs, application logs, and security logs to operate the service, diagnose errors, prevent abuse, investigate payment issues, and protect the community. Those logs are not advertising cookies.

8. Your cookie choices

You can control cookies through your browser settings. Depending on your browser, you may be able to delete cookies, block cookies, block third-party cookies, limit site storage, clear session data, or receive warnings before cookies are stored.

If you delete or block necessary HFi Shop cookies, you may be signed out and may need to log in again with Discord. Some flows may fail entirely, including checkout creation, billing portal access, account pages, admin tools, and identity-linked in-game redemption.

HFi Shop does not currently respond to browser "Do Not Track" signals because there is no common industry standard that tells sites exactly how to interpret those signals. If HFi adds optional analytics or advertising technologies later, the shop should also add a practical consent or opt-out mechanism where required by law.

9. Cookie and session retention

Session cookies and server-side session records may expire after inactivity, logout, browser closure, staff action, security review, or a configured retention period. Some related records, such as orders, Stripe event references, audit logs, refund records, support notes, and fraud-prevention evidence, may be retained longer under the Privacy Policy because they are needed for accounting, dispute, tax, security, fulfillment, or legal purposes.

10. Updates to this Policy

HFi may update this Cookie Policy as shop features, payment flows, legal requirements, browser standards, or third-party integrations change. The updated version will be posted on this page with a new effective or last-updated date.

11. Contact

Questions about cookies, privacy, login state, or account data should be sent through the Contact page or the official HFi Discord support channel announced by staff.