Cookie & privacy notice
Last updated: November 2026
This English version is provided for convenience. In case of any discrepancy, the German version shall prevail.
In short
CraftingHosting.free only uses technically necessary cookies – exactly the three listed below. There is no tracking, there are no analytics or marketing cookies and no third-party cookies. Consent is not required for this (§ 25 (2) no. 2 TDDDG). Should we ever use analytics tools, we will explicitly ask for your consent first.
Cookies set by this website
| Name | Purpose | Duration |
|---|---|---|
| chf_session | Sign-in: contains a random identifier of your session so that you stay signed in after clicking the email link. Not readable by JavaScript (HttpOnly), HTTPS only (Secure), SameSite=Lax. Only set when you sign in. | until you close the browser, at the latest 30 minutes after your last activity or 12 hours after signing in |
| chf_lang | Remembers your language choice (de/en). Only set when you switch the language. | 12 months |
| chf_consent | Remembers that you confirmed the cookie notice so that it does not appear again. | 12 months |
All three cookies only apply to the address under which you open the website. On the beta version of the website (if you have been approved for it), the same cookies are set separately.
What we store on the server alongside them
The cookies correspond to entries in our database. The database is encrypted as a whole; IP addresses and browser identifiers are additionally encrypted individually (AES-256-GCM).
- Session (chf_session): a hash of the session identifier (not the identifier itself), start, last activity and expiry as well as – encrypted – IP address and browser identifier. Deleted when you sign out or when it expires.
- Cookie notice (chf_consent): when you confirm it, we log the time, the encrypted IP address and the encrypted browser identifier as proof. Deleted after 90 days.
- Sign-in and registration: the IP address at registration and at the last sign-in (encrypted, until the account is deleted) and a security log of important actions with the encrypted IP address (90 days).
- Language (chf_lang): only in the cookie. If you are signed in, we additionally store the language you last used in your account so that emails arrive in the right language.
The purpose is to protect the service against abuse (e.g. multiple accounts, attacks). Details and legal bases are set out in the privacy policy.
Local storage and third parties
The website does not store anything in your browser’s localStorage or sessionStorage. Fonts and scripts are loaded from our own server – no third-party content that could set its own cookies is embedded. Only when you click a link to another site (e.g. to the panel, to Discord or to SumUp’s donation page) do that site’s cookie rules apply.
Deleting cookies
You can delete the cookies at any time in your browser settings. Without the sign-in cookie you have to sign in again via email link; without chf_consent the notice appears again.