Cookie Policy
Last updated 2026-06-03 · Version 1.1
1. What is a cookie
A cookie is a small text file stored by your browser when you visit a website. We also use related browser-storage technologies (localStorage, sessionStorage, IndexedDB) for the same kinds of purposes; this policy covers all of them collectively.
2. Categories we use
Strictly necessary (cannot be disabled while signed in)
| Name / family | Set by | Purpose | Lifetime |
|---|---|---|---|
sb-* | Supabase auth | Keep you signed in; CSRF protection | 1 hour (refresh token rotates) |
cf_clearance, __cf_* | Cloudflare Turnstile | Bot / captcha protection at signup, login, password reset | Session — 30 days |
ds_cookie_consent_v1 | DigiSurf | Remember which cookie categories you accepted | 12 months |
Functional / preference (set only by you)
| Storage | Purpose |
|---|---|
localStorage: ds_theme | Remembers your light / dark / auto theme |
localStorage: ds_mode | Remembers Academic vs General Training preference |
localStorage: ds_attempt_draft_* | Draft autosave on long Writing tasks so a refresh doesn't lose your work; cleared on submit or 30 days, whichever first |
Optional analytics — off by default
We currently operate no third-party analytics. We are evaluating Vercel Analytics (privacy-preserving, no PII, no fingerprinting). If we add it, the cookie banner will require fresh opt-in, this page will list it, and you will be able to revoke any time via Cookie preferences in the page footer.
Advertising / measurement — Meta Pixel
On our public marketing pages (landing and IELTS practice pages) we use the Meta (Facebook) Pixel and its server-side Conversions API to measure the performance of our Facebook/Instagram ads — for example, which ad led to a sign-up or purchase. This sets Meta cookies (_fbp, and _fbc when you arrive from an ad) and sends Meta a limited set of event data: the page viewed, the action taken (sign-up, purchase), your IP address, browser user-agent, and — for sign-ups and purchases — your email address and phone number in irreversibly hashed (SHA-256) form so they cannot be read by us in transit or by Meta as plain text. We do not send Meta your test answers, essays, recordings, scores, or any test content. This data is used for ad measurement and audience optimisation. See Meta's Data Policy. You can opt out of ad personalisation in your Meta ad settings, and browser extensions / Do-Not-Track tools that block the Pixel will not affect your access to the service.
3. Managing cookies
- In-app: click Cookie preferences in the page footer (when present) to update your choices.
- Browser: all modern browsers let you block, allow, or delete cookies in settings. Note: blocking strictly-necessary cookies will sign you out and break login.
- Do Not Track: we honour DNT for any optional analytics — if your browser sends DNT, we treat it as a refusal of optional categories.
4. Withdrawing analytics consent (DPDP §6(4)–(6))
Withdrawal must be as easy as granting consent. You can withdraw at any time from Cookie preferences in the footer. We will stop the relevant processing immediately and delete any non-essential storage on your next visit.
5. Changes
If we add a new cookie category (e.g. a new analytics vendor), we will update this page, reset the consent banner, and require fresh opt-in before activating it.
6. Contact
Cookie / privacy queries: privacy@digisurfacademy.com