This page lists the cookies and browser storage After The Timeout uses on afterthetimeout.com and app.afterthetimeout.com, what each one does, how long it lasts, and how to control them.
A cookie is a small piece of text a website saves in your browser so it can remember something between pages or visits. Local storage is similar, but it stays in your browser and is not sent to the site with each request.
1. Cookies needed to run the service
These are strictly necessary. Without them you cannot sign in or use paid tools, so they cannot be switched off on our side. None of them are used for advertising.
| Cookie | What it does | How long it lasts | Set on |
|---|---|---|---|
__Host-fre_session | Keeps you signed in. It holds a random token; we store only a hashed copy on our side. Scripts on the page cannot read it. | 30 days, or until you sign out | app.afterthetimeout.com |
__Host-fre_csrf | Stops other websites from submitting actions to your account while you are signed in. | 30 days, or until you sign out | app.afterthetimeout.com |
fre_link_device | Ties an emailed sign-in link (or a Google sign-in) to the browser that asked for it, so a link opened elsewhere asks you to confirm first. | 15 minutes | app.afterthetimeout.com |
__Host-fre_google_flow | Holds one-time security values while you are away at Google's sign-in page. | 10 minutes, deleted when you return | app.afterthetimeout.com |
ato_account | Lets both sites know you are signed in so menus show "My Account". It does not grant access to anything. | 30 days, removed when you sign out | afterthetimeout.com and app.afterthetimeout.com |
ato_ent_ + plan name (for example ato_ent_sims) | A signed pass that unlocks the paid tools you have access to, on both sites. It cannot be edited to unlock anything else. | About 33 days for a subscription, refreshed while it stays active. Up to 10 years for a one-time purchase. | afterthetimeout.com and app.afterthetimeout.com |
ato_cookie_consent | Remembers your choice on the cookie banner so it does not keep appearing. Analytics stay off until you choose "Accept"; "Essential only" keeps them off on both sites. | 1 year | afterthetimeout.com and app.afterthetimeout.com |
ato_attr | Only set if you arrive from one of our own campaign links (for example a link in our TikTok or Instagram bio). It remembers which link that was: the campaign labels in the link (utm_source, utm_medium, utm_campaign, utm_content), the page you landed on, and the time. If you later join the email list, create an account or subscribe, we save those labels with it so we know which post brought you. It holds no ID, is not shared with anyone, and is not used for analytics or advertising, so it is set whatever you choose on the cookie banner. The first link you arrive from is the one kept. | 30 days | afterthetimeout.com and app.afterthetimeout.com |
Cloudflare, which delivers both sites, may also set its own short-lived security cookie if it needs to check that a visitor is not a bot. That cookie is strictly necessary and is covered by Cloudflare's own cookie policy.
2. Analytics cookies
Most public pages on afterthetimeout.com, and the app's home page, landing page, and draft room, load Google Analytics 4, and pages on both sites load PostHog. They help us see how many people visit, which tools get used, and where people drop off between a first visit and subscribing. Neither is used for advertising, and we do not record sessions.
They only run if you say yes. Neither tool loads, sets a cookie or sends anything until you choose "Accept" on the cookie banner. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as "Essential only" without asking. You can change your choice at any time: open cookie settings (also in the Help menu).
| Cookie | What it does | How long it lasts | Set by |
|---|---|---|---|
_ga | Gives your browser a random ID so Google Analytics can tell one visitor from another. | 2 years | Google Analytics, on our domain |
ph_phc_nFU3pPVcrtqMvDhAgcdLSuSbhDubAEuYJCWV6BPcspx9_posthog | Gives your browser a random ID so PostHog can connect your visits across afterthetimeout.com and the app, and to your app account ID after you sign in. | 1 year | PostHog, on our domain (shared by both sites) |
_ga_C89G6XJ20M | Keeps track of your current visit, such as when it started and how many pages you viewed. | 2 years | Google Analytics, on our domain |
Neither runs until you choose "Accept" on the cookie banner. Choosing "Essential only", or making no choice, keeps both of them off on both sites.
3. Cookies on pages run by other companies
When you pay or manage your subscription, you are on Stripe's pages, and when you use "Continue with Google" you are on Google's sign-in page. Those companies set their own cookies there under their own policies. We do not control or receive those cookies.
4. Local storage in your browser
Some tools save your progress in your browser's local storage. It stays on your device until you clear it, and most of it never reaches our servers.
| Item | What it does |
|---|---|
fre_user_id | Remembers your app user ID while you are signed in. Removed when you sign out. |
ph_phc_nFU3pPVcrtqMvDhAgcdLSuSbhDubAEuYJCWV6BPcspx9_posthog | PostHog's copy of the same random ID and visit details, kept alongside its cookie. |
ato_room | Remembers the draft room code and your seat so you can rejoin a room. |
ato_fav_lineups | Saves the DFS lineups you mark as favorites. |
ato_cfb_draft_v2, ato_cfb_gone_v1, ato_cfb_picklog_v1, ato_cfb_myslot_v1 | Save your progress on the college football draft board: your picks, players taken, the pick log, and your draft slot. |
5. How to control cookies
- In your browser. Every major browser lets you see, delete, and block cookies and site data, usually under Settings, then Privacy. If you block the cookies in section 1, you will not be able to sign in or use paid tools.
- PostHog. Choose "Essential only" on our cookie banner, turn on your browser's Global Privacy Control or Do Not Track setting, or block cookies from our sites.
- Google Analytics. Choose "Essential only" on our cookie banner, block cookies from our sites in your browser, use a content blocker, or install Google's official opt-out add-on at tools.google.com/dlpage/gaoptout.
- Signing out removes the session cookies and the
ato_accountcookie. Deleting your account clears the sign-in and access cookies on that browser too. - Local storage is removed when you clear site data for our domains in your browser.
6. Changes and contact
If we add or change cookies, we will update this page and the date at the top. For how we handle personal information in general, see our Privacy Policy.
Questions: [email protected]