Cookie Policy

TO BE COMPLETED: this page has never been dated — set `lastUpdated` in src/lib/legal.js

This page lists everything this service stores on your device. It is a short list, because we do not track you.

The short version

We set no advertising cookies, no analytics cookies, and no third-party trackers.

The only cookies we set are the two that keep you signed in. Because those are strictly necessary to provide the service you asked for, we are not required to ask your permission for them — and we would rather not show you a consent banner that does nothing.

Cookies we set

Name	What it does	How long it lasts
accessToken	Keeps you signed in as you move between pages. Marked HttpOnly, so scripts on the page cannot read it.	Short-lived — minutes. Renewed automatically while you are active.
refreshToken	Lets us renew the token above without asking you to sign in again on every visit.	Until it expires or you sign out.

Signing out clears both immediately. Blocking them is possible in your browser, but you will not be able to stay signed in, which is the whole of what they do.

Other browser storage

The learning portal keeps a little state in your browser’s own storage so the interface behaves sensibly — which is technically not a cookie, and is covered by the same rules, so it belongs here.

What	Why
Application state (localStorage)	Remembers who you are signed in as and what you were doing, so a page refresh does not throw away your place. It stays on your device and is cleared when you sign out.

Third parties that may set their own cookies

We do not embed trackers, but two services set cookies on their own pages when you use them, under their own policies rather than ours.

When	Who	Their policy
Paying for a course or an event	Stripe, on Stripe's own checkout page, for fraud prevention and to complete the payment.	stripe.com/privacy
Signing in with Google	Google, only if you choose that option instead of a password.	policies.google.com/privacy

If this ever changes

If we add analytics, embedded third-party media, advertising or A/B testing, this page stops being accurate and we will need to ask your consent before any of it loads — with a real choice, refusing as easy as accepting, and nothing switched on in advance. We will update this page and the date at the top before that happens, not after.

Questions

Write to TO BE COMPLETED: privacy contact address, or read the Privacy Policy for what we do with data once it reaches us.