LLOADOUT
Legal

Cookie & Local Storage Policy

Last updated: 9 August 2026

This policy explains how Loadout, operated by IWG-IT ("we", "us"), uses cookies and similar browser storage on loadout.be and its venue subdomains. It should be read together with our Privacy Policy.

The short version

Loadout uses only strictly necessary (functional) cookies and storage. We do not use analytics, advertising, profiling or third-party tracking cookies, and we do not sell or share your data with advertisers. Because we set no non-essential cookies, there is nothing optional to switch off — everything below is required for the site to work and to keep you signed in.

Cookies we set

We set cookies on our own domain, and only once you sign in. They are what keep you signed in between visits. The two that can actually restore a session are marked HttpOnly — no script running in the page can read them, not ours and not one injected by anything else — and are sent only to the handful of addresses that renew or end a session, not to every request. All of them are SameSite=Lax, so your browser will not attach them to requests started by another site, and none is ever sent to a third party.

  • loadout_player_session — keeps you signed in to your player account. Expires 90 days after you last use Loadout; opening the app resets that, so it only runs out if you stay away for the full period.
  • loadout_operator_session — the same for venue operators in the operator console, with a shorter 30-day window, because those accounts carry more authority and are more often used on a shared machine.
  • loadout_player_session_present / loadout_operator_session_present — a companion to each of the above that says only that a session exists, so the app knows whether to ask to be signed back in rather than asking on every visit. Unlike the two above it is readable by the page, because that is its whole purpose; it holds no identifier, nothing about you, and grants nothing on its own.
  • loadout_last_view — the page you were on when you last used Loadout, so opening the app puts you back there instead of at the start every time. It holds a page address within Loadout and nothing else, and it is cleared when you sign out. Kept for 30 days.

The two session cookies hold a random value that means nothing on its own — it identifies a session record on our servers and contains no personal data. Signing out ends that record on our side, so the session cannot be resumed even if a copy of the cookie survives. Changing or resetting your password ends your other sessions, on every device — so recovering an account that someone else got into also puts them out of it.

What we store in your browser, and why

We also use your browser's local storage to run the service. These values stay on your device and are read by the app; they are not sent to third parties.

  • loadout.token / loadout.op.token — a short-lived key (about an hour) that authorises each request while you use the app. It is renewed from the session cookie above rather than being long-lived itself, which is what keeps a stolen device or a copied browser profile from granting months of access.
  • loadout.player — caches your own profile (name, email, preferences) so the app can show it without waiting for the network.
  • loadout.lang — remembers your language (English, Dutch, French or German).
  • loadout.marshal.tenant — remembers which operator a marshal is working for in the console.
  • loadout.cookie-consent — records that you have seen this notice, so we don't show the banner again.
  • loadout.imp / loadout.op.token.bak — set only on our own staff's browsers, and only while a support administrator is viewing the service as an account in order to help with a problem. They are never set on an ordinary visitor's device.

All of these — the cookies and the stored values alike — are essential to provide a service you actively requested (signing in, booking, running games), so under the ePrivacy rules they do not require prior consent. We tell you about them here for transparency.

Third-party services

Some pages load content from third parties. These providers may see your IP address and set their own cookies under their own policies:

  • Stripe — when you pay for a booking online, you are taken to Stripe's secure hosted checkout to enter your card details. Stripe sets its own cookies on its own domain to process the payment and prevent fraud. We never receive or store your full card number. See Stripe's cookie policy.
  • OpenStreetMap — venue maps load map tiles directly from OpenStreetMap in your browser, which means OpenStreetMap can see your IP address when a map is shown. It is used only to display maps and does not track you for advertising. See the OSM Foundation privacy policy.

Managing cookies and storage

Signing out is the most complete option: it clears what is stored in your browser and also ends the session on our servers. You can clear Loadout's cookies and local storage at any time from your browser settings (clearing site data for loadout.be), which signs you out on that device — though it leaves the session record on our side to lapse on its own, so use sign-out if you are on a device you don't control. Blocking essential cookies or storage will stop you from staying signed in and may break booking and other features.

Changes

If we ever introduce optional cookies (for example analytics), we will update this policy and add a proper consent choice before enabling them.

Questions? Contact us at privacy@loadout.be.

Loadout uses only essential cookies to keep you signed in and remember your preferences — no tracking or advertising. Learn more