Cookie & Tracking Policy

1. Strictly necessary storage (no consent required)

• token / device_token (localStorage or sessionStorage): keeps you signed in and remembers a trusted device for two-factor sign-in.
• lang, theme: your language and light/dark preference.
• pending_join_code, pay_country, pay_method: remembers a class code or your payment region/method during a flow.
• Stripe sets its own cookies on the checkout and billing-portal pages to prevent fraud (see Stripe's privacy policy).

2. Product analytics

We use PostHog to understand how staff use the product (page views, feature usage). Students are excluded. PostHog stores an identifier cookie/localStorage item (ph_*). We do not use advertising or cross-site tracking cookies and we honour the browser's Do-Not-Track signal.

Session replay is switched off. If the operator ever enables it, it applies to staff only and every input and all text are masked before anything leaves the browser.

3. Fonts and third-party requests

Web fonts are self-hosted and served from our own domain – no requests are made to Google Fonts or other font CDNs when you load the app. AI, e-mail, SMS and payment providers are described in the Privacy Policy.

4. Your choices

You can clear browser storage at any time (you will be signed out). Analytics opt-out is applied automatically for students and whenever the operator disables analytics; staff can also use browser Do-Not-Track.

5. Changes

Last updated: 2026-10-14.