Legal · cookies

Cookie policy

GROUPSPACE sets two cookies. Both are strictly necessary, neither tracks you, and there is no analytics or advertising cookie on the product today. This page names them.

Last updated 10 August 2026

Draft. This document is a working draft prepared for GROUPSPACE and has not been reviewed by a lawyer. Do not publish it as binding policy until counsel has read it — particularly the sections covering children’s data, and the Roblox and Discord platform terms it depends on.

Summary

There is no cookie banner on GROUPSPACE. That is not an oversight — there is nothing to consent to. We set two cookies, both of which are strictly necessary to sign you in and keep you signed in, and strictly necessary cookies do not require consent under the UK and EU rules.

Cookie	Type	Purpose	Lifetime
gs_session	First party, strictly necessary	Keeps you signed in across GROUPSPACE and your workspace subdomains.	[session cookie lifetime]
gs_oauth_state	First party, strictly necessary	Protects the platform sign-in flow against cross-site request forgery.	A few minutes — deleted as soon as the sign-in completes.

That is the complete list. No analytics cookies, no advertising cookies, no third-party cookies, no pixels.

The session cookie

gs_session is how GROUPSPACE knows who you are on each request. It holds a signed session reference — not your name, not your email, and not anything readable by a script on the page.

Attribute	Value	Why
Name	gs_session	—
Domain	.groupspace.xyz	So one sign-in works across the marketing site, the application and every workspace subdomain. Explained below.
HttpOnly	Yes	JavaScript cannot read it, so a cross-site scripting bug cannot steal your session out of the page.
Secure	Yes	Sent over HTTPS only.
SameSite	Lax	Sent on top-level navigation but not on cross-site subrequests, which blocks the common CSRF shapes while keeping ordinary links working.
Path	/	The whole application needs it.
Lifetime	[session cookie lifetime]	Signing out deletes it immediately, wherever it expires otherwise.

The cookie is a reference to a session record on our side. Signing out, or a session being revoked, invalidates that record — so a copied cookie stops working rather than remaining valid until it expires.

Why the parent domain

Every workspace gets its own subdomain. The marketing site and the account layer live on the parent domain. If the session cookie were scoped to a single host, you would have to sign in again on each workspace you belong to, and moving between two of them would mean two sign-ins.

Setting the cookie on .groupspace.xyz gives you one sign-in for all of it. That is single sign-on across your own workspaces and nothing more.

What a parent-domain cookie does not mean. It does not follow you off GROUPSPACE. A cookie scoped to .groupspace.xyz is only ever sent to GROUPSPACE — never to Roblox, never to Discord, never to any other site. It is not a tracking cookie, and it carries no cross-site identifier.

What it means for a workspace owner

Your workspace subdomain is part of the GROUPSPACE domain, so it shares this cookie. You cannot read it, and neither can anything you put on your workspace — it is HttpOnly and it is our cookie, not yours. Workspace membership and permissions still decide what you can see; the shared session only decides who you are.

The OAuth state cookie

gs_oauth_state exists for the few seconds you spend signing in with Roblox or Discord.

When you start a platform sign-in, we generate a random value, put it in this cookie, and send the same value to the platform. When the platform sends you back, the value it returns has to match the one in the cookie. If it does not, the request did not start with you and we reject it.

Attribute	Value
Name	gs_oauth_state
Contents	A random single-use value, and the page to return you to afterwards.
HttpOnly	Yes
Secure	Yes
SameSite	Lax — the platform redirects you back by top-level navigation, which requires the cookie to survive that hop.
Lifetime	A few minutes. Deleted as soon as the sign-in completes or fails.

Without it, someone could hand you a crafted sign-in link and attach your GROUPSPACE account to their platform account. It is a security control, and it cannot be disabled.

Analytics and advertising

GROUPSPACE sets no analytics cookies and no advertising cookies today. There is no third-party analytics tag, no advertising pixel, no remarketing tag, and no social embed that drops a cookie.

We do learn things about how the product is used, but from our own server logs and from error tracking — not from anything stored in your browser. Those logs are described in the privacy policy.

If that ever changes we will add a consent mechanism before the first non-essential cookie is set, not afterwards, and this page will be updated first. We are not going to quietly add a tag and rely on a banner nobody reads.

Other local storage

Cookies are not the only way a site can store something in your browser. For completeness:

Local storage. Used for interface preferences — sidebar state, table density, which panel you had open. No identifiers, nothing sent to us, and clearing it costs you nothing but the preference.
Session storage. Short-lived state within a single tab, such as an in-progress form.
Service workers and offline caches. Not used.
Fingerprinting. Not used, and prohibited for us in any case — Roblox’s third-party application rules forbid fingerprinting and cross-experience tracking.

Controlling cookies

Your browser can block or delete cookies, and you can do that for GROUPSPACE at any time.

Deleting gs_session signs you out. Nothing else breaks.
Blocking cookies for GROUPSPACE means you cannot sign in at all. There is no cookie-free mode, because holding a session without a session cookie is not something we can do.
Signing out from the application is the clean way to end a session — it invalidates the record on our side as well as clearing the cookie.

Since both cookies are strictly necessary, there is no in-product cookie setting to toggle. If one appears here later, it will be because a non-essential cookie appeared with it.

Changes

If we add a cookie, this page changes before the cookie ships. If the new cookie is not strictly necessary, a consent mechanism ships with it.

Questions go to privacy@groupspace.xyz.

The session lifetime on this page is unfilled, and the cookie attributes described here must be checked against what the application actually sets before this is published.

Verify against implementation Updated 10 August 2026

All legal documents Privacy policy Terms of service