Legal
Cookies & storage
Everything that lands in your browser, and everything that leaves it.
Provisional: this document is not approved yet
Everything below is a draft. It becomes the studio's approved position only when every administrator has signed this exact version in the client area. Until then, read it as an accurate description of what we do and intend, not as a document anybody has signed off.
Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it. What approval means here
This page lists every value any surface of ours writes into your browser, and every host your browser connects to while reading this site. It is one page rather than two because the law that governs the first does not care about the technology: regulation 5(1) of S.L. 586.01 covers storing information in, or reading information from, your device, whether that is a cookie, a local storage key or anything else.
There is no analytics, no advertising, no tag manager, no pixel, no embedded video, no map, no chat widget and no social button anywhere on this site. The table below lists all of it.
The three kinds, and which one travels
A cookie travels to the server with every request to the site that set it. Local storage and session storage never leave your device: the page reads them in your browser and the server is not told. That distinction matters more than the names: of everything listed below, exactly one is a cookie, it belongs to the signed-in client area, and it carries whether a navigation rail is open.
Session storage is cleared when you close the tab. Local storage survives until you clear your browser data, which you can do for this site alone from your browser's settings for it.
Every value, by name
Read out of the registry that the test suite holds to the source: a key written and not declared here fails the build, and so does a key declared here that nothing writes.
| Name | Kind | Where | What it is for | Lifetime | Basis |
|---|---|---|---|---|---|
gwg.site.age-confirmed.v1 | Local storage | this website | That you confirmed you are over 18, so the confirmation is not put in front of you on every page. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gwg.site.cookie-notice-seen.v1 | Local storage | this website | That you have seen the notice about this, so it is shown once. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gw:quality | Local storage | the game demos | Which graphics tier you chose, so a cheap phone is not asked to draw the full game every time you open one. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gw:quality-measured | Session storage | the game demos | That this device measured as slow during this visit, so the game does not re-measure and re-stutter on every cabinet you open. | Until you close the tab. | Strictly necessary (reg. 5(2)) |
gw:intro | Local storage | the game demos | That you turned the opening screen off. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gw:sound | Local storage | the game demos | Your sound settings: volume, mute, and which buses are on. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
sidebar_state | Cookie | the client area | Whether the navigation rail is open or collapsed. A cookie rather than local storage because the server renders the first screen and a rail that opens after the page has painted is a visible jump. | Seven days. | Strictly necessary (reg. 5(2)) |
sb-<project-ref>-auth-token | Local storage | the client area | Your signed-in session, written by the authentication library. There is no client area without it, and signing out removes it. | Until you sign out, or the session expires. | Strictly necessary (reg. 5(2)) |
bo-theme | Local storage | the client area | Whether you chose the light or the dark theme. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
bo-shelves | Local storage | the client area | Which sections of the navigation you left open. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gwg-projects-v1, gwg-projects-board | Local storage | the client area | Which project board you had open, and your unsent draft on it. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
gw:audiomix:prefs, gw:audiomix:prefs-unsynced | Local storage | the client area | The audio desk's own settings, and any mix not yet saved to the server. | Until you clear your browser data. | Strictly necessary (reg. 5(2)) |
animmix:saved:<skin> | Session storage | the client area | That an animation note was saved during this visit, so the desk can say so. | Until you close the tab. | Strictly necessary (reg. 5(2)) |
The last column is which half of regulation 5 an item falls under. Everything is in 5(2) today, which is why there is nothing to accept or refuse. Entries marked <project-ref> or <skin> are a family of keys whose suffix is decided at runtime.
Every request that leaves your browser
What a cookie-only policy cannot tell you, and often the part that matters more.
| Host | Who runs it | When | What is fetched | What they learn |
|---|---|---|---|---|
| fonts.googleapis.com | Google Ireland Limited / Google LLC (United States) | the game demos | The stylesheet for the typeface a demo cabinet is drawn in. A skin declares its own face and the cabinet asks for it when you open that demo. No page of this website asks for anything from here: the two faces the site itself is set in are served from this domain. | Your IP address, and which cabinet's face was asked for. No cookie is set by this request and nothing is sent back to us. |
| fonts.gstatic.com | Google Ireland Limited / Google LLC (United States) | the game demos | The font file for that cabinet's face. | Your IP address. The request is sent without credentials, so no cookie travels with it in either direction. |
| ycpvmmxfqnrsnwctjkvq.supabase.co | Supabase Inc. (United States), hosting in the European Union | the enquiry form, the legal pages and the client area | The database behind three things: the enquiry form on the contact page, which is sent here when you press send and not before; the question a legal page asks about whether its current text has been approved, which carries the page's address and a hash of its text and nothing about you; and the client area's sign-in and every figure it draws. | Your IP address on every one of those requests. From the enquiry form, what you typed into it: your company, your name, your work address and your message. From the client area, your sign-in address and what you asked it for. There is no player personal data in the database it fronts (see the privacy notice). |
Reading this site reaches no font, script or tracker host
Until 5 October 2026 the first two were, on every page: the typefaces came from Google's servers, which sent your IP address to a third party before you had clicked anything. No cookie was involved, which is why a cookie-only policy would never have mentioned it. Eight of the nine provider sites we read do not.
Every face this site is set in, including the thirty-seven the footer's wordmark spins through, now comes from this domain with its licence and copyright line beside it in /fonts/NOTICE.txt. Google is reached only if you open a demo cabinet, which asks for the face its own skin declares. The database is reached in three cases: by a legal page asking whether its own text has been approved (it sends the page's address and a hash, nothing about you), by the enquiry form when you press send, and by the client area once you sign in.
Why there is no consent banner
Everything stored here is strictly necessary, so there is nothing to ask permission for.
Regulation 5(2) of S.L. 586.01 exempts storage that is strictly necessary to provide a service you explicitly asked for. Everything on this page is in that category: an age confirmation you gave, a notice you dismissed, a graphics tier you chose, your sound settings, your theme, and the session that is the client area. None of it is used to recognise you anywhere else, none of it is shared, and none of it reaches us.
So there is no consent banner. The IDPC's guidance requires accept and refuse to carry equal prominence on the same layer, forbids pre-ticked boxes, forbids making access conditional on consent, and does not accept scrolling as agreement. A banner built to that standard would ask permission for storage that needs none, and would suggest that we do something we do not do.
Turning it off, and taking it back
Every browser can block or clear storage for one site from its own settings for that site, and clearing it here costs you nothing except being asked to confirm your age again and seeing the notice once more. Nothing on this site breaks without it, and nothing re-creates a value you removed except the surface you used next.
There is no consent to withdraw, because nothing on this site is stored on the basis of consent. If that changes, the control appears in the notice at the foot of the page and this sentence changes with it.
This site sends no Do Not Track or Global Privacy Control signal anywhere, because it has nothing to send one about. It also does not read yours, because there is no tracking here to switch off in response to it.
What a game inside a casino stores
A game of ours embedded in a casino runs inside that casino's page. What the page around it stores (its own session, its analytics, its advertising) is theirs and is covered by their cookie notice, not by this page. Our own frame keeps a session token for the round in progress and the graphics and sound settings listed above, and that is all.
Contact
Anything about this page, including a value you found in your browser that is not listed on it, goes to hello@getawaygaming.com. A key we are storing and have not declared is a defect in the same class as a wrong figure on a game page, and we want it reported the same way.
Provisional until every administrator has approved this version. Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it.