Cookies

Because we only set cookies that are strictly necessary to run the service you asked for: signing you in and keeping you signed in. UK rules do not require consent for that, and asking you to dismiss a banner for it would be theatre.

We do count visits to two pages, without a cookie: that is explained below, with a switch to turn it off. If we ever add anything that sets a cookie to track you, we will ask properly before switching it on.

• The session cookie. Set when you sign in, so every page you open knows it is you. Without it you would be signed out on every click.
• The return cookie. Remembers which page you were trying to reach, so signing in puts you back there rather than on the home page.
• The sign-in form cookie. A token that proves the sign-in form you submitted is the one we handed you, so another site cannot submit it on your behalf.
• They are all first-party. Only our own site can read them, and they go nowhere else.
• They hold no revision data. Just proof you signed in, where you were going, and that the form was ours.
• They expire. Sign out, or clear your browser cookies, and they are gone.

• Three more, for a few seconds. Starting a Google sign-in sets three short-lived cookies and they are gone by the time you are back here.
• They are what makes the handshake safe. Between them they prove the browser finishing the sign-in is the one that started it, that another site did not start it on your behalf, and that the answer we got back is the answer to our own question.
• They are ours, not Google’s. First-party, like the other three, and they hold nothing about you.
• Google will know you signed in here. That is unavoidable, because it is how asking them to confirm who you are works, and it is the reason signing in with a password is still offered.

We count visits to two pages: the home page and the page where you make an account. It tells us how many people come, where they came from, and how many go on to sign up. We use a counter called Umami for this. It runs on our own servers, its script is served from this site, and no cookie is set.

For each visit to one of those two pages, it records:

• Which of the two pages it was.
• The website you came from, if you followed a link: the site only, never the page on it.
• Your browser, operating system and type of device, as your browser announces them to every website it visits.
• Roughly which country you are in, worked out from your internet address at the time.
• Whether you went on to make an account. Not which account.

It never:

• Counts anything once you are signed in: your revision, your work, your tutor conversations and everything else in the app are not part of it.
• Records your name, your email address or your account.
• Keeps your internet address. It is used for a moment to work out the country and to tell one visitor from another for that day, then dropped.
• Recognises you the next day. A visitor is told apart from others by a code that changes every day and cannot be turned back into your address.
• Shares anything with anyone, or follows you to other websites.

A counted visit is kept for 13 months and then deleted. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. You can also switch it off for this browser here. Your choice is remembered in your browser, which is the one thing the counter ever stores there:

• Google Analytics, or any analytics that sets cookies.
• Advertising or retargeting pixels.
• Social media trackers.
• Anything that follows you to other websites.

This is not us being coy. Nothing on the site loads from another company’s servers. The one script we did not write, the visit counter above, is a copy served from our own address, on two pages. You can check in your browser’s network tab.

You can block cookies in your browser settings. LearnInc will still load, but you will not be able to sign in or stay signed in, so the app will not be usable. There is no way around that, because it is how being signed in works.

More on what we hold and why: Privacy.