Cookies
New Zealand has no separate cookie statute. The Privacy Act 2020 still applies to personal information. This page lists what this website stores in the browser, and which other sites the pages call. It is not legal advice. Collection and retention are in the privacy notice.
No banner
We do not show a cookie banner. We do not load advertising scripts or third-party analytics. The storage below is essential: player sign-in, operator sign-in, a signed-out booking-link tap, and the test chat. This site also loads one first-party script, mm-beacon.js, which tells our own server the page path and a short label for a link or button. It does not set a cookie, and it does not call any other company. We keep those rows for 90 days. If we add a third-party tracker or anything else that is not essential, we will ask on the screen before it runs, and rejecting that choice will leave it unloaded.
mm_session
A cookie. Essential for a player's sign-in on this website. It is set only when you open a one-hour sign-in link that Match Maker sent you on WhatsApp (a thematchmaker.app/l/… link). Each link works once.
- The value is a random session id. Our database keeps a hash of it, not the id itself, with your WhatsApp number, so the site knows which player is signed in.
- HttpOnly, so scripts on the page cannot read it.
- SameSite=Lax. Path=/. On the live site it is also Secure.
- It lasts 30 days from sign-in. Using the site extends it to a year from that day, at most once a day, so you stay signed in until you sign out or don't visit for a year.
- Clearing it signs you out. Signing out on the site also ends the session on our side.
- It does not give access to the operator pages.
Visits to the home page, the calendar, and these legal pages do not set this cookie.
If you tap a match card's booking link while signed out, two short-lived cookies are set for one day: mm_next remembers that link so you land back on it after signing in, and mm_bfid carries a random, non-identifying funnel id used to count how many card taps reach Playtomic. When that tap is saved, a third cookie, mm_pa, is set for seven days. Its value is a random token and a signature. It does not contain your name, your phone number, or a database id. It is HttpOnly, Secure, SameSite=Lax, and Path=/.
mm_admin
A cookie. Essential for the operator. It is set only after a successful sign-in at the operator login (/admin/login).
- HttpOnly, so scripts on the page cannot read it.
- SameSite=Lax. Path=/. On the live site it is also Secure.
- No expiry date. It ends when the browser session ends.
- Clearing it signs the operator out.
Visits to the home page, the calendar, and these legal pages do not set this cookie.
mmChatId
A localStorage key on the test chat only. /chat is a test companion on this website. It is not live WhatsApp. When you pick or create a mock player, the page writes that player's id into this key. When the page loads, it deletes the key. It does not read the key back, so a refresh does not restore the player.
- The home page and the calendar do not set it.
- It is not advertising and it is not used to follow you across other websites.
- Clearing site data for thematchmaker.app removes it.
Other sites these pages call
- This site. Pages, the logo, the home-page QR image, and the Caveat wordmark font. The font file is hosted here under the SIL Open Font License. The home page does not call Google Fonts.
- WhatsApp. If you open the Match Maker chat, you are on Meta's site. Any cookies there belong to Meta.
- Open-Meteo. Our server asks for a weather forecast at the club. That does not set a browser cookie and does not send your name or number.
- api.qrserver.com. When a joinable match is open on the calendar, the browser loads a QR image from that host. The request includes the join link. We do not control cookies on that host. This is not Match Maker analytics.
- Playtomic or a club website. Only if you follow a booking link.