In short
PitStop only uses strictly necessary technical storage: session cookies when you sign in, Cloudflare Turnstile’s anti-abuse check, three preferences in the browser’s local storage and the pit wall game’s settings. There are no advertising, social media or analytics cookies. That is why we show no consent banner: this storage is exempt under article 22.2 of the Spanish LSSI-CE.
What we store
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| __Host-pit_stop_access (cookie) | The API (pit-stop-api.xmassoftware.com) | Keep you signed in | Minutes; renews itself |
| __Secure-pit_stop_refresh (cookie) | The API | Renew the session without typing your password again; only sent to the authentication routes | Up to 30 days from sign-in |
| pit-stop.session (local storage) | The website | A flag with no account data saying this browser signed in, so the API is not queried if you never did | Until you sign out |
| pit-stop.theme (local storage) | The website | Remember the light theme if you choose it (dark is the default) | Until you go back to the dark theme |
| pit-stop.world (local storage) | The website | Remember which solo career or league you had open in the office (only its identifier) | Until you clear the site’s data |
| Game settings (browser storage) | The pit wall game (pit-stop-play.xmassoftware.com) | Keep your video, audio, accessibility and interface options | Until you clear the site’s data |
Session cookies are HttpOnly (JavaScript cannot read them), Secure (HTTPS only) and SameSite (not sent from other sites). They only exist if you sign in and are removed when you sign out. The pit wall game uses no cookies: it receives a one-time pass when it opens and does not share the website’s session.
Anti-abuse protection
Registration, sign-in, password recovery and verification resend use Cloudflare Turnstile to check you are human. Turnstile may use storage strictly necessary for that security check, not to track you across sites.
Cookieless analytics
We measure visits in aggregate with Cloudflare Web Analytics on public pages. It uses no cookies or browser storage and builds no visitor profiles.
How to control it
You can delete or block cookies and local storage in your browser settings. If you block session cookies you will not be able to sign in, but public content stays available. If we ever added something that needs your consent, we would ask you first with a notice.
Contact: info@xmassoftware.com