Cookie Policy

Cookies are small files stored on your device by a website. We also use localStorage and sessionStorage. This policy describes their purposes, names or name patterns and duration. Analytics identifiers can distinguish a browser or signed-in user and are personal data; they are not anonymous merely because they do not contain your name. We do not use these tools to serve personalised advertising.

Optional analytics and session replay are separate choices, off until you actively agree and adult eligibility permits capture. Earlier analytics choices do not authorise replay. Choices expire after 180 days, or sooner if purposes or providers materially change. Necessary storage and your requested language do not depend on optional consent. You may change or withdraw consent at any time:

• Use the Cookie settings link (also in the footer) to re-open the consent panel.
• Toggle analytics from your profile’s privacy settings.
• Clear or block cookies in your browser settings.

Rejecting is as easy as accepting. Blocking strictly necessary cookies may prevent you from signing in or using parts of the platform.

Browser privacy controls

Used only where needed to provide a requested function, such as signing in, choosing a language, preserving an editing session or protecting a form. Rejecting optional cookies does not disable these functions.

• Authentication — Supabase browser storage uses names such as sb-[project-ref]-auth-token and related sign-in verification records. It maintains and refreshes your session until you sign out, the session expires or you clear storage. Temporary sign-in verification records are used during the sign-in flow. Signup continuation uses tab-scoped discentik:pending-email-signup for your email and private birth-date/residence declaration, valid for one hour. It is removed after saving to your account, an account change, expiry cleanup or closing the tab. The temporary discentik:signup-declaration handoff for external sign-in is valid for 15 minutes.
• Course previews — localStorage keys beginning coursePreviewDraft_ temporarily preserve course-preview data. Drafts become invalid after six hours and are removed during a later read or cleanup; you can also clear them through your browser.
• Consent record — discentik_cookie_consent in localStorage stores your choices, policy version and time. The choice is valid for 180 days. The stored record can remain until replaced or cleared, but an expired choice does not authorise optional analytics.
• Requested language — NEXT_LOCALE and DISCENTIK_UI_LOCALE_EXPLICIT cookies remember English or Spanish for up to 365 days. They support the language you request and do not grant analytics consent.
• Help feedback — discentik.help.feedback.visitor and discentik.help.feedback.vote.[article] localStorage records remember a vote you choose to submit and help prevent duplicates. They remain until removed or you clear site data.
• Embedded Course Player — discentik-unsynced-runtime-v1:* holds exercise backups until a save acknowledgement removes them; discentik-ai-client-session maintains an AI conversation session. The player also stores accessibility-settings. These use localStorage, with session or memory fallback when unavailable. Records without a specific expiry remain until removed or cleared; session-only records end with the browser session.
• Security checks — Cloudflare Turnstile may use browser storage when a protected form requests a challenge; challenge data and duration depend on the security check. Payment and external sign-in providers explain storage on their own pages before you use those services.

Where the reviewed feature is available, eligible adults may separately allow recordings of how they use our public pages. For signed-out visitors who agreed from 11 October 2026, recordings show those pages as they appear, including their text, images and layout; form fields, typed text, the website assistant and anything marked sensitive stay hidden. Earlier choices and signed-in recordings stay masked. From 12 October 2026, sign-up and sign-in pages are also recorded with all their text and fields hidden, showing only layout, scrolling and clicks. Documents, messages, answers, console and network content are excluded. Private account, payment, administration and pupil-data pages are not recorded. Recordings are limited to 30 days. Recording choices do not enable analytics or affect learning access. Children and unknown ages cannot use optional tracking. Signed-out visitors confirm they are 18 or older by choosing Accept all or the preference checkbox; this is remembered with the cookie choice and is not a verified age check.

Optional measurements help us understand usage and improve the service. They start only after consent and also respect your account-level analytics opt-out. Essential course progress, completion and saved exercise work are still processed to deliver training and let you resume.

• First-party learning analytics — optional detailed stage metrics, such as time and attempts, are stored in Discentik’s systems. These are separate from the progress and exercise records needed to provide the course.
• PostHog — optional product events, performance and filtered error reports through our first-party permission boundary to the EU service. The reviewed adapter uses in-memory SDK storage and random monthly provider identifiers, not account IDs or cross-month aliases. A signed-out visitor who requests eligible optional capture receives a first-party discentik_privacy_recovery localStorage handle. It expires 12 months after creation without activity renewal, separately from the 180-day consent choice. Browser privacy controls in Cookie settings provide an optional recovery code and deletion/status requests for linked PostHog records. A pending request proof remains until its status is resolved; clearing or expiring browser storage is not proof of deletion. We retain minimal first-party consent evidence and issue short-lived capture permissions. Native automatic click capture is disabled; separately consented replay uses only the reviewed masked recorder.
• Google Analytics 4 — traffic and navigation measurement after consent. Google uses _ga and _ga_[measurement-id] cookies, configured for 180 days without automatic renewal and scoped to this host. Advertising signals and ad personalisation are disabled. Discentik’s explicit pageview events omit query strings and use filtered locations and titles. Google also receives technical connection information when its tag is loaded.

Withdrawing consent stops optional collection and removes accessible analytics storage where supported. It does not recall data already sent. You can clear remaining site data in your browser or contact us about deletion of personal data already collected. Provider-side event retention is separate from browser-cookie duration and is covered by the Privacy Policy.

Optional tools run only after consent for the relevant purpose and the required eligibility checks. Analytics consent does not authorise session replay, and replay consent does not authorise analytics. Other providers may process data when you request a protected form, payment or external sign-in; these essential operations do not enable optional tracking. Google and Microsoft sign-in, Stripe payment pages and provider security services have their own privacy and cookie information.

If we change which cookies we use we will update this policy and, where required, ask for your consent again. See our Privacy Policy for how we handle personal data and your rights.