Cookie policy · Slowplay AI

1. Current use

You do not need to log in to browse the public landing pages, policy pages and product descriptions. Where account login is available, we may use essential cookies that maintain your login session. For email login, the cookie is __Host-runlot_auth from the Runlot authentication platform. For Google login, the cookies are __Host-slowplay_session, which Slowplay AI issues directly, and __Host-slowplay_oauth, which is used only during login. We also store two first-party cookies in limited cases. The first is slowplay_attr, which remembers which campaign you came from, and we set it only when your first visit is through a link that carries an ad campaign value in the address (such as utm_source) or an ad click ID. The second is slowplay_ref, which remembers an invite code, and we set it only when you visit through a friend invite link (a link with ?referral= and an invite code). Apart from these cookies, we do not use analytics or advertising cookies, pixels or third-party tracking SDKs, and we do not run personalized advertising or behavioral profiling for advertising purposes. Usage analytics for improving the service (records of screen navigation and button clicks, and screen recordings for logged-in accounts) are processed without cookies and only on servers the operator runs directly. They are described under "Types of storage technology" below.

The Runlot authentication platform manages the expiry and detailed settings of the Runlot authentication cookie. When you use the tutorial, progress information (stars, best score, number of attempts, first completion time and last attempt time) is stored in your browser's localStorage. This information stays only in the current browser. It is not sent to the server or synced between devices. If you clear site data in your browser, your progress record is also removed. If you opt out of usage analytics in this browser, only that choice is stored in localStorage (slowplay.analytics.optOut). In environments where development or test sign-in is enabled, the test sign-in state and the scenario ID to resume from may also be stored in localStorage. When you start a paid credit payment, an order duplicate-prevention key is stored in sessionStorage so that the same order is not created twice. It is cleared when you reach the order status screen and disappears when you close the tab. Server and hosting security logs are not cookies and follow the access and security information standards in the privacy policy.

2. Cookies and similar technologies

A cookie is a small value that a website stores in your browser. Browser storage, pixels, SDKs and device identifiers can be used in similar ways to keep you logged in, remember settings, or for statistics or advertising, so this policy covers them as well.

3. Types of storage technology

Essential: These cookies keep your login session in environments where login is available. Email login uses __Host-runlot_auth from Runlot authentication. Google login uses __Host-slowplay_session, which Slowplay AI issues directly (30 days; only a hash of the value is stored on the server). During Google login, we also briefly use the __Host-slowplay_oauth cookie (10 minutes; deleted when login completes or fails) to verify that the request matches. All of them are needed for login and authentication, and we do not use them for advertising or analytics.
Browser storage: Your tutorial progress is saved in the browser's localStorage. If you decline usage analytics in this browser, that single choice is saved in localStorage under the slowplay.analytics.optOut key. This is essential storage used only to remember a setting you requested, and it does not create any usage analytics record. Only when development or test login is enabled, test login information and a pending scenario ID may also be stored. When you start a payment, an order duplicate-prevention key is stored only in sessionStorage for the current tab. This storage data is not a cookie, and it is not used for advertising purposes.
Campaign measurement (first-party cookie): The slowplay_attr cookie, stored only when you first arrive through an ad link. It holds only the campaign values in the link address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the name of the ad click ID type (only which of gclid, gbraid, wbraid, ttclid or fbclid was present, never the ID value itself), the path of the first page opened (without the query part of the address), the host name of the previous site, and the time of the first visit. It is kept for 30 days and, when you finish signing up (adult eligibility check), the server reads it once, records it, and deletes it. If this cookie already exists, it is not overwritten, so the first campaign you visited is kept. We do not pass it to or share it with ad platforms or other third parties, and we do not use it for ad personalization or cross-site behavior tracking.
Friend invite (first-party cookie): This is the slowplay_ref cookie, which we store only when you visit through a friend invite link (a link with ?referral= and an invite code in the address). It holds a single item: the inviter's invite code (six characters). It is kept for 30 days. When you finish signing up (adult eligibility check), the server reads it once, registers the invite code to that account, and then deletes the cookie. If this cookie already exists, it is not overwritten. If an account that is already logged in opens an invite link, the cookie is deleted. We do not use it for advertising, do not pass it to or share it with third parties, and do not use it for cross-site behavioral tracking.
First-party usage analytics (no cookies): The operator performs this analytics directly, and no third-party analytics tool or provider is involved. It records screen navigation paths and button clicks. For logged-in accounts, it also keeps screen recordings (which capture changes on the screen but mask the contents of input fields and text you type yourself). It creates no cookies and stores no visitor identifier in your browser. The browser stores only your opt-out choice (slowplay.analytics.optOut, essential storage). Records are stored only on servers the operator runs and are not passed to advertisers or third parties. Screen recordings are kept for 30 days, and navigation and click records for 180 days. Visits without login are counted only as daily view totals that cannot identify any individual, and are kept for 400 days. You can opt out with the button on this page, in your account settings, or through your browser's GPC signal. If an account opts out, that account's existing records are also deleted.
Advertising and targeting: These are technologies used for ad personalization or cross-site behavioral tracking. We do not currently use them, and no plan to introduce them has been decided.

4. Consent and choices

We do not use optional advertising cookies. First-party usage analytics is announced in advance through this policy and the Privacy Policy, without a prior consent prompt, and it applies to logged-in accounts that have not opted out. You can opt out at any time, and you can still use all features after opting out.

Opting out is no harder than consenting, and it takes a single action. Choose whichever is most convenient: the "Opt out of usage data collection in this browser" button below this section, the "Usage data collection" setting on your My Page (/profile) when logged in, or your browser's Global Privacy Control (GPC) signal. If your GPC signal is on, we treat it as an opt-out without any further action and do not count daily view counts either. If you opt out in your account, that account's existing screen recordings and navigation and click records are also deleted. If you allow collection again, recording resumes from that point.

For accounts whose country, chosen in the adult eligibility check, is in the EEA (European Economic Area), the United Kingdom or Switzerland, we do not record screen navigation, clicks or screen recordings. If we introduce other optional analytics or advertising technologies, we will disclose the provider, purpose and retention period before applying them. Where the law requires it, we will let you give clear consent or decline. You must be able to withdraw consent at any time as easily as you gave it, and after withdrawal we stop recording any new optional values.

This browser has not opted out of usage analytics. Check the description above for what we collect and how we use it.

5. Managing cookies in your browser

In your browser settings, you can view, delete or block cookies and stored data for each site.
If you block essential authentication cookies, login and account features may not work properly.
You can use your browser's tracking protection or privacy features. If you turn on the Global Privacy Control (GPC) signal, we treat it as an opt-out of usage analytics.
Deleting or blocking the campaign measurement cookie (slowplay_attr) does not affect login or use of the service; it only means which ad you came from is not recorded.
Deleting or blocking the friend invite cookie (slowplay_ref) does not affect your use of the service. The only effect is that the invite code is not registered automatically when you sign up. You can register the code by entering it yourself in "Code I used" in your profile or in the code field on the payment screen.
You can change your opt-out or opt-in choice for usage analytics at any time, using the "Opt out of usage data collection in this browser" button on this page ("Allow again" after you opt out) or the "Usage data collection" setting on My page. Clearing your browser's site data also clears the opt-out choice stored in this browser. An opt-out made through account settings stays with your account.

6. External services

The Runlot authentication platform manages the email login session cookie, and Slowplay AI manages the Google login session cookie directly. For Google login, Slowplay AI sends you to a Google screen and receives the authentication result directly. Cookies that Google uses on the Google screen follow the Google Privacy Policy, and Slowplay AI does not set them on its own pages. We have not connected any third-party analytics or advertising tools to the app, and usage analytics is processed only on servers the operator runs directly. Paid credit payments take place on Polar's payment screen (polar.sh). Cookies and storage technologies that Polar uses on that screen follow the Polar Privacy Policy. Slowplay AI does not set Polar's storage technologies on its pages. If an external provider later sets browser storage technologies on this site, we will add their purpose and usage details to this page.

7. Changes and inquiries

If storage technologies are added or changed, we will update this policy before they actually take effect. The revision of this Cookie Policy (addition of usage analytics) takes effect on November 16, 2026. The provisions on advertising campaign cookies apply from November 14, 2026, as announced in the notice of November 6, 2026. For personal information processing in general, please see the Privacy Policy. Contact: 리스너즈(lysners) · js@lysners.com