Cookie Preferences
There are no preferences to set, because every cookie TCG Bolt uses is required for the site to work. This page lists them rather than offering you switches that would do nothing.
1. Why there is no cookie banner
Consent banners exist because most sites carry advertising and analytics cookies that a visitor should be able to refuse. This one does not. We run no third-party advertising, no ad networks, no advertising based on who you are, no marketing pixels and no third-party analytics scripts in your browser. Sellers can pay to have a listing placed higher, and those placements are labeled; they use no cookies and know nothing about you.
Cookies that are strictly necessary to deliver a service you asked for do not require consent, and those are the only kind here. A banner offering to turn off the cookie that keeps you signed in would be theater.
2. Before you sign in, nothing
Browsing this marketplace signed out sets no cookies at all. Not one — not a session, not a preference, not an identifier waiting to be matched up later. You can read every listing, every policy and every help page and leave without this site having written anything to your browser.
That is worth stating plainly because it is unusual, and because it means the rest of this page is about a short list that only begins when you ask for an account.
3. Every cookie this site uses
Set by us
| Name | What it does | How long |
|---|---|---|
| tcgbolt.session_token | Tells the server which account is making a request. It is what being signed in is — without it there is no way to have an account at all. | 7 days |
| tcgbolt.session_data | A short-lived copy of who you are, so that most pages can be drawn without asking the database again. It is a speed measure and nothing else; deleting it costs a database lookup. | 5 minutes |
| tcgbolt.two_factor | Only if you have turned on two-factor sign-in, and only between entering your password and entering the code. It holds your place in that one sign-in, then goes. | 10 minutes |
| tcgbolt.admin_session | Only in an administrator’s own browser, while they are signed in as another account to look into a problem. It keeps their own session so they can return to it. It is never set in yours. | 7 days |
The first two are set when you sign in and cleared when you sign out. All four are HttpOnly, so no script on the page can read them, and SameSite=Lax, so they are not sent along with requests started by another site. On the live site all four are Secure, meaning they travel over HTTPS only.
Set by Stripe, on the checkout page only
Stripe’s payment library sets its own cookies to detect fraudulent card use. They are set when a payment form loads — which happens on the two checkout pages and nowhere else on this site — and we neither control them nor can read them. Stripe’s own privacy policy governs them.
Nothing else stores anything either
Cookies are not the only way a site can keep something in your browser, and the rules that cover them cover the alternatives too. We use none of them: no local storage, no session storage, no indexed database, no tracking pixels, no browser fingerprinting.
4. What we do not use
- No advertising or retargeting cookies.
- No social media pixels or share-button trackers.
- No third-party analytics scripts running in your browser.
- No cross-site tracking of any kind.
We do measure how the marketplace is used — which pages get opened, how far a listing gets through review, whether checkouts complete. That measurement happens on our server, from actions you take here, and sets nothing in your browser. It is described in the Privacy Policy.
5. Turning them off anyway
Every browser can block or clear cookies, usually under Settings → Privacy. Clearing them here signs you out, and blocking them entirely means you cannot sign in or pay — not because we are withholding anything, but because there is nowhere left to keep the fact that you are signed in.
6. Do Not Track and Global Privacy Control
We honor the Global Privacy Control. Because we do not sell or share personal information and run no advertising cookies, the signal asks nothing of us that we were not already doing — we recognize it rather than ignore it, so a browser sending one gets a straight answer. We do not respond to Do Not Track, which has no agreed meaning. Both are covered in the Privacy Policy.
7. If this changes
Adding a cookie means adding it to the table above before it is set, and a cookie that is not strictly necessary means a banner and a real choice rather than a paragraph explaining why there is not one. That is the order those two things have to happen in.
Material changes carry a new effective date and notice before they take effect.
8. Contact
HaulX LLC, 1424 Turnwood Run, Josephine, TX 75135. Questions about anything on this page: support@tcgbolt.com.
Effective 25 September 2026.