Cookie Policy

No third party sets a cookie on our website during ordinary use. Everything listed here is set by us, on our own domain.

We do not use advertising or tracking cookies at all. There is no advertising network, no retargeting pixel, no social media tracker and no data broker in this product. There is nothing to opt out of on that front because there is nothing there.

The cookies we do set fall into three groups:

• Necessary. Your signed-in session, and the record of your cookie choices. These cannot be switched off, because switching off the session cookie signs you out and switching off the consent cookie means we have to ask you again on every page.
• Preferences. Language, currency, theme and layout. These make the site look and read the way you set it. We read them on the server so the page arrives correct rather than flashing a default first. They are written only after you accept preferences, or at the moment you change one of these settings yourself.
• Analytics. Product analytics through PostHog, and only after you accept. Before you accept, PostHog is not loaded at all: it is not merely muted, the code is never fetched.

The main landing page shows no banner, because nothing on it needs your consent. Until you decide, that page writes no preference or analytics cookie, keeps nothing in your browser on your behalf (apart from what keeps a signed-in session working) and sends nothing to an analytics or performance service. The one exception is a setting you change there yourself, such as the theme or the language: we remember that choice because you just made it. Every other page shows the banner as soon as you arrive without a decision, and you can change your mind at any time with the "Manage cookies" link in the footer, the landing page included.

One thing worth knowing that most cookie policies get wrong about themselves: on the web, PostHog stores its state in local storage rather than in a cookie. So if you go looking for an analytics cookie you will not find one, even with analytics turned on. The data is still there, it is just not in a cookie, and a policy that called it a cookie would be misleading you about where to look.

A cookie is a small file the site asks your browser to store and send back on the next request. Because it is sent back, the server can read it. That is why our language and theme preferences are cookies: the server needs them to render the first page correctly.

Local storage is a larger store that stays in your browser and is never automatically sent to us. The server cannot read it. We use it for things only the browser needs, such as your study widgets, your todo list and the state of a quiz in progress.

Legally these are usually treated the same way. The ePrivacy rules speak of storing or accessing information on a user's device, not of cookies specifically. So this document lists both, and marks which is which, rather than listing only the cookies and letting the larger store go unmentioned.

These cannot be disabled without breaking sign-in or your consent choice.

• sp_consent (cookie, 1 year). Records the choices you made in the consent banner: which of the three categories you accepted, the version of the consent schema, and the date you decided. Also mirrored into local storage under the same name so that a change in one browser tab takes effect in your other tabs immediately.
• Supabase authentication session (cookie, lifetime set by Supabase Auth). Keeps you signed in. The name follows the pattern sb-[project]-auth-token, so it varies by environment rather than being a fixed string. Deleting it signs you out.
• sp-install-id (local storage, until you clear it). A random identifier for this browser installation, used to keep locally stored study state associated with the right device. It is not linked to your identity and it is not sent to an advertising network.
• sp-authed (cookie, up to 400 days, only while you are signed in). Says only whether your session is valid, so pages can skip account requests when nobody is signed in. It carries no token and no identity, and it is removed on your next visit once your session has ended.

Staff only. Two further cookies exist and you will never receive them unless you are an administrator of this Service: sp-admin-mfa, holding a short-lived second-factor grant, and sp-impersonation, holding a support impersonation grant. They are listed because a complete inventory means complete.

These remember how you like the site. All of them last one year and all are first-party. Turning them off does not break the Service, it just means it forgets your choices between visits.

• sp-lang. Your interface language.
• sp-currency. The currency prices are displayed in.
• sp-theme and sp-dark. Your colour theme and whether you use dark mode.
• sp-skin. Your visual Concept, meaning which of the overall design styles you chose.
• sp-concept-prefs. Your per-Concept colour and font choices.
• sp-landing-concept and sp-landing-dark. The same two settings for the public landing pages, kept separately so the marketing site and the app can differ.
• sp-nav-mode, sp-sidebar-collapsed and sp-sidebar-autohide. How your navigation and sidebar are arranged.

We read these on the server. That is the entire reason they are cookies rather than local storage: without them the server would send you a page in the default appearance and your browser would repaint it a fraction of a second later, which is visible and unpleasant.

When they are written. Only after you accept preferences in the banner, or when you change that setting yourself (the theme switch, the language menu, the sidebar button), because that write records your own choice. If you have chosen nothing, we work out the language and currency from your country on each visit and use them for that page only, without storing them.

Only set if you accept analytics in the consent banner.

• ph_[key]_posthog (local storage, not a cookie). PostHog's own store, holding an anonymous distinct identifier and queued events. Alongside it PostHog keeps a few ph_[key]_... entries in session storage for the current tab, which end when the tab closes. All of them are written only after you consent. If you decline, the PostHog code is never loaded, so nothing is written and no event is sent.

We use PostHog to understand which features are used and where people get stuck. If you withdraw consent later, we instruct PostHog to stop capturing immediately and it stops within the same page view.

Error reporting through Sentry runs for every visitor, and this one is worth being precise about. Sentry receives crash reports containing stack traces, the URL and recent interactions. It is currently anonymous: we do not attach your account identity to error reports. Performance timings (how long a page takes to load or to change, measured on about one page load in ten) and session counts (used to work out how often the app crashes) are different: they are sent to Sentry only after you accept analytics. Sentry sets no cookie and writes nothing to browser storage on our domain.

None of this is sent to our servers automatically. It stays in your browser until you clear it. It is listed in full because a partial list is worse than none.

The interface state below is written on your behalf, so it is stored only after you accept preferences, unless it records something you did yourself (closing a guided tour, for example).

Study and productivity tools:

• sp-todo-items, sp-postit-text, sp-habits, sp-habit-done-[date], sp-daily-goal, sp-hydration-goal, sp-countdown-date, sp-login-streak, sp-study-rounds. Your widgets and study habits.
• sp-quiz-sessions, sp-exam-in-progress, study_exams, sp-history. Quiz and exam state, so that closing a tab mid-session does not lose your place.
• sp-pseudo. A display name you chose for yourself locally.

Interface state:

• sp-widgets-no-autoopen-v1, settings_scroll_[tab], hero-demo-watched, sp-try-tour-v2. Small reminders of what you have already seen or arranged.
• sp-active-days. The days on which this browser opened the app, for the activity strip and streak on Home.
• sp-nt-glass, sp-nt-lg-active, sp-nt-rain-profiles, sp-landing-lab-overrides. Visual effect settings for particular design Concepts.
• sp-pet-defaults-off-v1, sp-pet-last-check-in, sp-pet-ground-shadow, sp-pet-need-bubble, sp-pet-care-enabled. Desk pet settings.
• breakzone.version, breakzone.pp2.gallery. Break Zone state.
• flashcards-qcm-lang, flashcards-qcm-dark, flashcards-qcm-skin. Legacy names for language, dark mode and Concept, kept for compatibility with older stored values. They hold the same information as the cookies above.
• sp-lang, sp-landing-concept, sp-landing-dark, sp-concept-prefs. Local mirrors of the preference cookies.

The iOS and Android apps do not use cookies, because they are not web browsers. They store the equivalent information in the operating system's own app storage, which is removed when you uninstall the app.

The categories are the same: your session, your preferences, and analytics if you have accepted it. The Privacy Policy describes what the mobile apps additionally collect, notably push notification tokens and purchase receipts.

Where the apps open a legal document or a support page, they open it in a browser view, and this policy applies to that view.

Use the cookie settings link in the footer of any page. It reopens the consent banner with your current choices shown, and you can change any of them. This is the easiest route and it is the one we would like you to use, because it lets us honour your choice properly rather than guessing from an absent cookie. On the main landing page, where the banner does not open by itself, this link is the way to it.

Your browser can also do it. Every major browser lets you view, block and delete cookies and site data, usually under Privacy or Site Settings. Be aware that:

• Deleting the necessary cookies signs you out.
• Deleting the sp_consent cookie makes the banner appear again, because we no longer know what you chose.
• Deleting local storage clears your locally held study state, including a quiz in progress and any widget arrangement.
• Blocking cookies entirely will prevent you from signing in.

Do Not Track and Global Privacy Control. We do not use advertising or cross-site tracking, so there is nothing for these signals to switch off here. We honour your consent banner choice, which is more specific than either signal.

Withdrawing consent does not delete what was already collected. To ask for that, write to support@studyprepai.app, which is a separate right described in the Privacy Policy.

Withdrawing consent stops new writes, not old ones. Once you turn preferences or analytics off we stop writing on that basis, but what is already in your browser stays until it expires or you clear this site's data in your browser settings.

We will update this document whenever we add or remove a cookie or a storage key. Because the list is generated from a written inventory of the code rather than from a template, a change to the product is meant to force a change here in the same edit.

Material changes are announced the same way as changes to the Privacy Policy, and the effective date at the top of this page is revised when they take effect.

Questions about this policy, or about anything stored on your device by this Service: support@studyprepai.app.

Related documents: the Privacy Policy at /legal/privacy, the Terms of Service at /legal/terms, and the Refund Policy at /legal/refund.