Legal
Last updated: May 31, 2026 · Effective date: May 31, 2026
Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device, remember your preferences, and collect usage data. Some cookies are set by us ("first-party cookies") and others are set by third-party services we use ("third-party cookies").
We also use browser local storage — a similar technology that stores data in your browser rather than as cookies.
The current public launch of CodeOak uses essential authentication cookies and a small amount of browser local storage for product preferences. A cookie consent banner is shown so you can record your analytics and marketing preferences.
Third-party analytics cookies (Google Analytics 4) and advertising cookies (Google Ads) are not active at launch. They are planned for a future release and will be loaded only after we enable them and you have opted in through the consent banner. When that happens, this policy will be updated before the change goes live.
| Category | Examples | Status | Can be opted out? |
|---|---|---|---|
| Essential | Supabase session cookies | Active | No — required for login |
| Functional (local storage) | Theme and profile preferences | Active | Yes — clear browser storage |
| Analytics | Google Analytics 4 | Not yet active | Will be via cookie banner when enabled |
| Marketing | Google Ads conversion | Not yet active | Will be via cookie banner when enabled |
These cookies are required for account login and session continuity. Without them, authenticated parts of CodeOak will not work. You cannot opt out of these cookies.
| Cookie name | Purpose | Duration | Provider |
|---|---|---|---|
| sb-[project]-auth-token | Maintains your authenticated session | Session / auto-refreshed | Supabase (first-party) |
| sb-[project]-auth-token-code-verifier | Supports secure PKCE login flows | Session | Supabase (first-party) |
Supabase cookie names include your project reference. The pattern above shows the general format.
We use browser local storage for lightweight product preferences. These values remain in your browser until cleared or overwritten and are not transmitted to our servers unless explicitly needed.
| Key name | Purpose | Persists |
|---|---|---|
| codeoak.theme | Remembers your theme preference | Until cleared |
| codeprep.user.profile_prefs | Stores selected practice preferences locally | Until cleared |
| codeoak.legal.acceptance.pending | Tracks whether legal acceptance still needs to sync | Until synced |
| codeoak.cookie.consent | Records your cookie consent choice (analytics, marketing) | Until cleared |
We plan to integrate Google Analytics 4 in a future release to understand how visitors use the website. Google Analytics uses a pseudonymous client ID (not your name or email). IP addresses will be anonymised before being stored.
When analytics are enabled, this policy will be updated and a cookie consent banner will be shown before any non-essential cookies are set.
| Cookie name | Purpose | Duration | Provider |
|---|---|---|---|
| _ga | Distinguishes unique users (pseudonymous client ID) | 2 years | Google Analytics |
| _ga_[ID] | Stores and counts pageviews for a GA4 property | 2 years | Google Analytics |
| _gid | Distinguishes users within a 24-hour session | 24 hours | Google Analytics |
| _gat | Throttles request rate to Google servers | 1 minute | Google Analytics |
We may use Google Ads conversion tracking in a future release to measure how many users who clicked on a CodeOak advertisement subsequently signed up. We do not use these cookies to show personalised ads on other websites.
When advertising measurement cookies are enabled, this policy will be updated and a consent banner will be shown first.
| Cookie name | Purpose | Duration | Provider |
|---|---|---|---|
| _gcl_au | Stores and tracks ad conversion information | 90 days | Google Ads |
| _gcl_aw | Captures the click identifier from a Google Ads click | 90 days | Google Ads |
Cookie consent banner
A consent banner appears at the bottom of the screen so you can accept or reject analytics and marketing cookies. Your choice is saved locally (in the codeoak.cookie.consent key) and the banner will not reappear once a decision is made. Because analytics and advertising cookies are not active at launch, no such cookies are set until those features are enabled and you have opted in.
Browser settings
You can configure your browser to block or delete cookies at any time. Blocking essential cookies will prevent you from logging in.
Google Analytics opt-out (when active)
Install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout to opt out across all websites.
Google Ads opt-out (when active)
Manage Google ad personalisation settings at adssettings.google.com. You can also opt out of interest-based advertising at optout.aboutads.info.
We may update this Cookie Policy when we add or remove cookies or change how we use them. If we enable new tracking technologies, this policy will be updated before those changes go live. The "Last updated" date at the top always reflects the most recent revision.
