Cookie Policy
A short page, because there is not much to declare. The platform runs on three cookies it cannot work without, and nothing else unless your school turns it on.
The three the platform cannot work without
These are set by the application itself. They carry no advertising identifier and are not shared with anyone.
| Cookie | What it does | Lasts |
|---|---|---|
laravel_session | Keeps you signed in as you move between pages. Without it every click would be a fresh, anonymous visit. | 2 hours of inactivity |
XSRF-TOKEN | Proves a form submission came from a page we served, not from a hostile site in another tab. This is a security cookie: removing it would expose every form in the product to cross-site request forgery. | Session |
remember_web_* | Set only if you tick "remember me" at sign-in, so you are not asked again on that device. | Until you sign out |
All three are HTTP-only where the browser allows it, and carry the Secure flag over HTTPS. They are exempt from consent requirements because the service cannot be delivered without them — but they are listed anyway, because "strictly necessary" is a category that gets abused.
Things we store on your device but do not send back
Some state lives in your browser's local storage rather than in a cookie, which means it never travels to our servers:
- Light or dark theme, so the product does not flash the wrong one on every page load.
- Draft recovery in the content editor. A long article being written in the admin console is autosaved locally, so a closed tab or a browser crash does not lose an hour's work.
- Dismissed tips and completed product tours, so an onboarding hint you have already read does not reappear.
You can clear all of it from your browser at any time. The only cost is that the theme resets and dismissed hints come back.
Analytics — off unless switched on
This is the part most cookie policies are vague about, so to be exact: on a default installation this site sets no third-party or advertising cookies whatsoever.
Google Analytics 4, Google Tag Manager and the Meta pixel are supported, but each loads only when an administrator has entered the corresponding ID in platform settings. If no ID is configured, the script is never rendered and the cookie never exists.
Where they are configured, those providers set their own cookies under their own policies, typically to count visits and measure which pages lead to enquiries. They are used on the public marketing website. We do not run advertising or behavioural tracking inside a school's workspace, and we do not track children — the DPDP Act 2023 prohibits behavioural monitoring and targeted advertising directed at children, and independently of that we would not build it.
You can refuse or delete cookies in your browser settings, and use Google's own opt-out tools for its analytics. Blocking the three strictly necessary cookies above will stop you being able to sign in — that is not a dark pattern, it is what a session cookie is for.
Related pages
What is held about students, parents and staff, and who is responsible for it, is covered in the Privacy Policy. How access is enforced technically is on the Security page.
Questions about anything here: support@schooltechy.com.