Cookie Policy
Last updated 2026-06-03 · Version 1.1
1. What is a cookie
A cookie is a small text file stored by your browser when you visit a website. We also use related browser-storage technologies (localStorage, sessionStorage, IndexedDB) for the same kinds of purposes; this policy covers all of them collectively.
2. Categories we use
Strictly necessary (cannot be disabled while signed in)
| Name / family | Set by | Purpose | Lifetime |
|---|---|---|---|
sb-* | Supabase auth | Keep you signed in; CSRF protection | 1 hour (refresh token rotates) |
cf_clearance, __cf_* | Cloudflare Turnstile | Bot / captcha protection at signup, login, password reset | Session — 30 days |
ds_cookie_consent_v3 | DigiSurf | Remember which cookie categories you accepted | 12 months |
Functional / preference (set only by you)
| Storage | Purpose |
|---|---|
localStorage: ds_theme | Remembers your light / dark / auto theme |
localStorage: ds_mode | Remembers Academic vs General Training preference |
localStorage: ds_attempt_draft_* | Draft autosave on long Writing tasks so a refresh doesn't lose your work; cleared on submit or 30 days, whichever first |
Optional analytics — off by default
Since 12 August 2026 we operate one optional analytics vendor: Vercel Web Analytics (Vercel Inc.). It is privacy-preserving — no cookies, no device storage, no PII, no fingerprinting — and collects only the page path, referrer, country, device type and browser, aggregated. It never receives your account identifier, test content, essays, recordings or scores.
It is off by default and loads only after you choose Accept all. Adding it reset the consent banner, so every visitor was re-prompted for fresh opt-in. You can revoke any time via Cookie preferences in the page footer — collection stops immediately, without a reload. If your browser sends Do Not Track, it never loads at all.
Advertising — Google AdSense (free tier only)
Free accounts and visitors may be shown advertising served by Google AdSense (Google LLC). AdSense sets advertising cookies and may use identifiers to select and measure ads; Google's use of data is described in Google's own privacy policy. It loads only after you choose Accept all in the cookie banner, never for Pro subscribers (a paid account removes all advertising), never inside a running timed test, and never if your browser sends Do Not Track. Revoke any time via Cookie preferences in the footer. Adding this category reset the consent banner, so every visitor is re-prompted for fresh opt-in.
Advertising / measurement — Meta Pixel
On our public marketing pages (landing and IELTS practice pages) we use the Meta (Facebook) Pixel and its server-side Conversions API to measure the performance of our Facebook/Instagram ads — for example, which ad led to a sign-up or purchase. This sets Meta cookies (_fbp, and _fbc when you arrive from an ad) and sends Meta a limited set of event data: the page viewed, the action taken (sign-up, purchase), your IP address, browser user-agent, and — for sign-ups and purchases — your email address and phone number in irreversibly hashed (SHA-256) form so they cannot be read by us in transit or by Meta as plain text. We do not send Meta your test answers, essays, recordings, scores, or any test content. This data is used for ad measurement and audience optimisation. See Meta's Data Policy. You can opt out of ad personalisation in your Meta ad settings, and browser extensions / Do-Not-Track tools that block the Pixel will not affect your access to the service.
3. Managing cookies
- In-app: click Cookie preferences in the page footer (when present) to update your choices.
- Browser: all modern browsers let you block, allow, or delete cookies in settings. Note: blocking strictly-necessary cookies will sign you out and break login.
- Do Not Track: we honour DNT for any optional analytics — if your browser sends DNT, we treat it as a refusal of optional categories.
4. Withdrawing analytics consent (DPDP §6(4)–(6))
Withdrawal must be as easy as granting consent. You can withdraw at any time from Cookie preferences in the footer. We will stop the relevant processing immediately and delete any non-essential storage on your next visit.
5. Changes
If we add a new cookie category (e.g. a new analytics vendor), we will update this page, reset the consent banner, and require fresh opt-in before activating it.
6. Contact
Cookie / privacy queries: info@digisurfaustralia.com.au