COOKIE POLICY
LAST UPDATED: APRIL 2026 · ePRIVACY DIRECTIVE 2002/58/EC · PECR · CCPA
1. What are cookies?
Cookies are small text files stored on your device when you visit a website. “Similar technologies” include localStorage, sessionStorage, IndexedDB, tracking pixels, SDK identifiers, and device fingerprints. This policy covers all of them.
2. Categories of cookies we use
| Category | Purpose | Consent |
|---|---|---|
| Strictly Necessary | Sign-in session, authentication tokens, security (CSRF), load balancing, cookie-consent record itself | Not required (essential) |
| Functional | Language, theme (light/dark), tab selection, progress continuity across sessions | Required (opt-in) |
| Analytics | Aggregated anonymous usage measurement (page views, session duration, error tracking) | Required (opt-in) |
| Marketing | Not currently used. Reserved for referral tracking if ever enabled — would require fresh consent. | Required (opt-in) |
3. Specific items stored on your device
| Name | Category | Type | Retention | Purpose |
|---|---|---|---|---|
| ap2_cookie_consent | Necessary | localStorage | 12 months | Stores your consent preferences per category |
| ap2_auth / ap2_user | Necessary | localStorage | Session / 30 days | Signed-in state, no password stored |
| ap2_theme | Functional | localStorage | 12 months | Light/dark preference |
| ap2_progress | Functional | localStorage | Persistent | Quiz progress, bookmarks, notes |
| __Secure-firebase-* | Necessary | Cookie (first-party) | Session | Authentication (if Firebase enabled) |
| analytics_* | Analytics | Cookie/localStorage | 13 months | Aggregate usage metrics, only with opt-in consent |
This list is kept up to date. Some items may be absent depending on your configuration.
4. Legal basis for cookies
Under the ePrivacy Directive 2002/58/EC (as amended) and its national transpositions (e.g. UK PECR, France Loi Informatique et Libertés), strictly necessary cookies may be set without consent; all other cookies require prior informed consent. Under GDPR, where cookies involve personal data, the cookie consent also forms the lawful basis for that processing.
5. How to give, refuse or withdraw consent
On your first visit you see a banner letting you Accept All, Reject All or open Cookie Preferences to choose per category. Refusing is as easy as accepting. You can change your mind anytime via the Cookie Settings link in the footer; changes take effect immediately and we do not set the rejected categories on subsequent visits.
You can also manage cookies via your browser settings (delete, block, prompt). Note that disabling strictly-necessary cookies will prevent the Service from working.
6. Global Privacy Control & Do Not Track
We honour the Global Privacy Control (GPC) browser signal where recognised by law (California, Colorado, Connecticut). If we detect a GPC signal we will treat it as an opt-out of “sale”/“sharing” under CCPA/CPRA and as withdrawal of non-essential cookie consent. We do not currently act on the legacy DNT header because no consistent standard exists.
7. Third-party cookies
We do not serve third-party advertising cookies. Third-party services (Gumroad checkout, Firebase) may set their own cookies on their domains during payment or authentication flows; their policies apply: Gumroad, Google Firebase.
8. Changes
We keep this list up to date. Significant changes are notified via the banner or email. See the “Last updated” date above.