Last updated 5 August 2026
HexMetrics runs no advertising and no cross-site tracking, and sets no analytics cookies. We set one cookie, and it exists to keep you signed in. Everything else listed here stays on your device and is never sent to us.
We do measure traffic. It is cookieless, it stores nothing on your device, and it does not identify you or link to your account. The Analytics section below says exactly what it records.
We do embed media that other people host: news images, podcast artwork and audio, and video. Those hosts see a request from your browser. None of them set a cookie through us, and the Third-party requests section below says exactly when each one is contacted.
| Name | Purpose | Attributes | Lifetime |
|---|---|---|---|
| ff-refresh-token | Keeps you signed in and lets the app get a fresh session without asking for your password again | HttpOnly, Secure, SameSite=Strict, Path=/api/auth | 24 hours |
HttpOnly means scripts running in the page cannot read it, which is what protects it from cross-site scripting. SameSite=Strict means it is not sent on requests originating from other sites. The narrow path means it is only ever sent to the authentication endpoints.
This cookie is strictly necessary to provide a service you asked for, so it does not require consent under the ePrivacy Directive. If you sign out, it is deleted.
These are preferences and working state. They are written by the app in your browser, they are readable only by hexmetrics.app, and they are never transmitted to our servers. Clearing your browser storage removes all of them and costs you nothing but your display preferences.
| Key | What it holds |
|---|---|
| ff-theme | Light or dark theme |
| ff-theme-choice | Whether you picked that theme yourself, rather than being given the default |
| ff-team | The NFL team whose colours you picked |
| hex-team-icons | Whether team icons are shown |
| hex-lineup-color | Lineup colour mode |
| hex-flex-badge | Flex badge style |
| hex-logo-variant, hex-font-dir | Logo and type display options |
| hex-pool-prefs | Draft pool sort, source and position filter |
| ff-confirm-picks | Whether draft picks ask for confirmation |
| ff-undo-window | Your undo window preference |
| ff-coach-collapsed | Whether the HexCoach rail is collapsed |
| ff-draftaid-<league id> | Draft aid working state for one league |
| ff-trades-<league id> | Trade view state for one league |
| ff-notif-dismissed | Notifications you have dismissed |
| hex-sim-games-played | Simulated week, for previewing the season |
| hex-config-overrides | Local model configuration overrides |
| hex-logo-admin | Admin-only display flag |
| hex-video-team | The club whose video you were last browsing |
| hex-podcast-team | The club whose podcasts you were last browsing |
We use Cloudflare Web Analytics to count page views and measure how quickly pages load. That is why the section above can say "no analytics cookies" while this section exists: the measurement is real, but it sets no cookie and writes nothing to your device.
It records the page address, the page that referred you, your user agent and screen size, a country derived from your IP address at the edge, and page-load timings. There is no persistent identifier, so repeat visits are not stitched into a profile, and none of it is joined to your account.
Because it stores nothing on your device and reads nothing from it, this measurement does not require consent under the ePrivacy Directive. Where the GDPR applies we rely on legitimate interests, and we use the least identifying data that answers the question.
Loading a page also makes requests to third parties who then see your IP address and user agent as a normal consequence of serving a request. Web fonts are loaded from Google Fonts. Player images are loaded from the NFL, ESPN, and Sleeper content networks. Those providers set no cookies through us, but the request itself is visible to them.
The media sections add more of these, and they are worth naming because two of them behave differently from the rest.
None of this is unique to HexMetrics: it is how podcast and video playback works anywhere. We set no cookies through any of these providers, and none of them are given your name, email address, or date of birth.