Review draft · not an accepted contract
Legal, district and independent security review remain required. Publishing these pages does not establish compliance.
What we do now
The language preference uses a first-party cookie for up to one year. Color mode uses local device storage until changed or cleared. Authentication uses necessary session cookies; their lifetime depends on the configured session.
What we do not collect or enable
No marketing cookies, click histories, login recents or tracking pixels are introduced. Private responses are not intended for shared caches.
What changes in future versions
Any new nonessential storage needs a separate purpose and legal review. New versions do not authorize tracking.
Read the full draft
Cookie details. The locale cookie contains an allowlisted language, uses SameSite=Lax and Secure on HTTPS, and is readable by the interface. Supabase session cookies use SameSite=Lax and Secure in production; they are readable by the browser SDK and must not be described as universally HttpOnly. Synthetic demo sessions use their separate, limited session mechanism.
Control and limits. Browser settings can clear language/color preferences; blocking necessary storage may interrupt sign-in or preferences. Public pages do not open student workspace stores. Existing historical browser artifacts may remain on a device: a release boundary that does not read them is not proof that every old copy has been deleted. Offline support uses a generic fallback; no account record should be cached by the public site.
EN/ES editorial text; human legal and translation review pending.
Contact & requests
A monitored public channel is pending. Invited professionals: contact your invitation issuer without records or credentials.