Cookie Policy

1. What cookies are

Cookies are small text files a website stores in your browser. We also use browser storage (localStorage and sessionStorage) for the same purposes. This policy covers both. Cookies are either strictly necessary (the Platform cannot work safely without them) or optional (used only according to the choice you make in the consent banner).

2. Strictly necessary (always active)

• Authentication session cookie (__Host- prefixed, httpOnly): keeps you signed in securely. Lifetime: your session, or longer if you choose "Remember me". Never readable by scripts.
• CSRF protection cookie (gfm_csrf / __Host-gfm_csrf): protects signed-in requests against cross-site forgery. Lifetime: session.
• CSRF token copy (gfm_csrf, localStorage): the browser’s own copy of the value above, which is what allows you to stay signed in after refreshing or reopening a page. It is not a credential and cannot be used to sign in. Lifetime: until you sign out.
• OAuth state cookie (set only during Sign in with Google): protects the sign-in handshake against tampering. Lifetime: minutes.
• Consent storage (gfm_consent, localStorage): remembers the consent choices you made, with the date and policy version. Lifetime: 12 months, or until you change your choices.
• Cloudflare Turnstile: when human verification is active, Cloudflare may set its own cookies strictly to distinguish humans from bots, under Cloudflare’s privacy policy.

3. Analytics and attribution (your choice)

If you decline analytics, the Platform stops sending analytics events from your browser and marketing-related events are dropped. Strictly necessary cookies continue to work — they carry no analytics.

• Visitor identifier (gfm_aid cookie): a random first-party identifier linking your visit — and the campaign that referred you — to a later registration. Contains no personal details; our analytics store no IP addresses. Lifetime: 12 months.
• Session marker (sessionStorage): remembers that your visit already recorded its landing page, so it is counted once. Lifetime: until the tab closes.
• Education progress markers (sessionStorage): remember that a learning journey was already counted on a page. Lifetime: until the tab closes.

4. Marketing (your choice)

We currently set no third-party marketing cookies. The marketing choice in the consent banner governs marketing emails and any future marketing integrations, which would be listed here (with a version bump to this policy) before being enabled.

5. Third-party sites

Partner brokers and external sites you visit through the Platform set their own cookies under their own policies. Our sponsored links are marked, and the Risk Disclosure and Affiliate Disclosure explain the relationship.

6. Changing your choices

You can change or withdraw your consent at any time using the "Cookie preferences" control on this page or in the site footer. Your new choice takes effect immediately for this browser. You can also clear cookies in your browser settings; doing so signs you out and resets your preferences.