Legal
Exactly what we store on your device — and what we don't.
Last updated: 23 August 2026 · Effective: 23 August 2026
Pairs with the privacy policy. Questions → contact.
Cookies are small text files set by your browser; localStorage is similar browser storage. Both store data on your device to remember auth, preferences and to keep the platform secure. This policy covers both, as we use localStorage for theme and dismissed announcements and cookies for the Appwrite session.
a_session_{PROJECT_ID} — Appwrite session (auth, httpOnly on subdomains via proxy.ts), rate-limit keys (rate-limiter.ts), CSRF Origin check (proxy.ts:131/CSRF:15) and Razorpay/Stream session handling. Without these you cannot stay logged in or access protected /app, /admin, /instructor, /moderator routes. No consent needed; they are required by law to provide the service.
theme (light/dark/system via theme-provider.tsx localStorage theme), dismissed announcement hash (announcement-banner.tsx ab-announcement-dismissed:{hash} per announcement), and draft auto-saves (use-auto-save.ts buff-draft-*) that flush on unmount. These remember choices and do not track across other sites.
Vercel Analytics (@vercel/analytics) if enabled — aggregated page views, Web Vitals (vitals.vercel-insights.com via CSP next.config.ts:83), no advertising profile. You can block analytics via content blockers without breaking the app.
Razorpay checkout (checkout.razorpay.com script/frame next.config.ts:79) and Stream (chat.stream.io) set their own cookies under their policies when you pay or use chat. Video embeds (YouTube/Vimeo frame-src next.config.ts:84) may set player cookies. We do not allow third-party advertising or cross-site tracking cookies.
Session cookies expire on logout or Appwrite expiry (validated cached 15s proxy.ts:18); preference keys persist until you clear them; Upstash Redis rate-limit keys expire in 60s (rate-limiter.ts:1); analytics cookies per Vercel's retention. You can delete localStorage keys buff-draft-* and theme manually and they are recreated.
Browser settings let you block or clear cookies/site data at any time — clearing them signs you out, resets theme and re-shows announcements, but does not affect purchases/enrollments (stored server-side). For theme, use the toggle (theme-toggle.tsx) instead of blocking storage. Do Not Track is not required to be honoured, but blocking analytics still works.
We will update the Last updated date here and link from the privacy policy. Combined with /privacy, this explains everything stored on your device — questions? Use /contact or the grievance officer on /grievance-redressal.