Cookies

__Secure-dmaxgame-session

Your sign-in. A random lookup key, not your details — the record it points at lives on the server and can be revoked, which is what makes signing out instant.

Where it goes: This sign-in host only. Never shared with any other subdomain.

How long: 30 days, or until you sign out.

__Secure-dmaxgame-identity

Your name, your picture address and your three settings, signed so an app can trust them without being able to forge them. This is what lets a game greet you by name without asking this portal anything.

Where it goes: Shared across dmaxgame.com and its subdomains, deliberately — it is the thing that has to travel.

How long: About fifteen minutes. It is re-issued as you move about.

dmaxgame-refresh-tried

A note that says an app already tried once to get a fresh identity, so it does not try again in a loop.

Where it goes: Shared across the family.

How long: A few seconds.

dmaxgame-oauth-state

A one-time value used to check that a Google or Discord sign-in came back from the same request that started it.

Where it goes: This sign-in host only.

How long: Until the sign-in finishes, then deleted.

dmaxgame-oauth-pending

Holds a part-finished provider sign-in while you are choosing a username.

Where it goes: This sign-in host only.

How long: Until the sign-in finishes, then deleted.

dmaxgame-oauth-return

Where you were when you clicked sign in, so you can be put back there afterwards. Checked against a list of this family's own addresses and ignored if it is anything else.

Where it goes: This sign-in host only.

How long: Until the sign-in finishes, then deleted.

Because one cookie doing both jobs is a bug waiting to happen, and it was caught on paper rather than in use. The long-lived one that proves you are signed in stays on this one host. Only the short-lived, signed name-and-face token is shared with the rest of the family.

If the 30-day one were shared instead, every address in the family — including a half-finished one — would receive a full sign-in on every request, and one error page printing its own headers would hand it over. The short one expires in minutes and carries nothing worth stealing.

Signed out, this portal remembers the last app you opened in your browser’s own storage, under dmaxgame:last-app, so the front page can offer to take you back. It never leaves your browser and it is not sent anywhere. Signed in, that preference lives on your account instead — which is how it manages to work on your phone as well as your laptop — and you can turn it off in settings.

Individual games keep their own saves in your browser as well. What each one stores is on the privacy page.

Blocking these cookies means you cannot sign in — there is no other way to remember you between two requests. Everything that does not need an account still works: the games play, and every page of this portal renders.