This policy explains the cookies, localStorage, sessionStorage, and short-lived provider tokens used by Smart Cub Learning. Strictly necessary storage supports login, learning-session continuity, anti-abuse checks, and checkout. Google Analytics measures public marketing pages and attribution can connect a campaign visit to coarse funnel milestones such as adult activation, diagnostic completion, trial start, or first payment. Advertising networks (Google, Meta, Reddit, Microsoft, TikTok) may show relevant Smart Cub Learning ads to the adult visitor on other sites. Optional analytics and advertising storage is enabled by default on adult acquisition routes and can be withdrawn at any time through Cookie settings. Providers do not receive a child identifier, answer, score, skill result, or profile, and advertising tags never load on learner routes. Optional PostHog product analytics uses adult account ID/email or a pseudonymous learner ID/role, and masked session replay where enabled. We do not sell browsing data.
1. Scope
A cookie is a small value stored by a browser and sent with matching web requests. localStorage and sessionStorage stay in the browser and are not sent automatically. This inventory covers storage we create directly and the principal security and payment storage used during the Cloudflare Turnstile and Stripe-hosted parts of a journey.
2. Current storage inventory
| Identifier | Technology | Provider | Purpose | First or third party | Duration |
|---|---|---|---|---|---|
| ph_<project-key>_posthog | TechnologyCookie, localStorage and sessionStorage | ProviderPostHog (EU endpoint) | PurposeOptional site and product measurement, identity/session state and masked replay configuration, only after analytics permission. | First or third partyFirst-party browser storage used by PostHog | DurationCookie up to 365 days; localStorage until withdrawn or cleared; sessionStorage for the tab. Removed on analytics withdrawal. |
| ph_<project-key>_primary_window_exists, ph_<project-key>_window_id, ph_<project-key>_session_registered_properties, ph_<project-key>_replay_pending_buffer | TechnologysessionStorage | ProviderPostHog | PurposeOptional session/window coordination and temporary masked replay state where enabled. | First or third partyFirst party | DurationBrowser tab session. Removed on analytics withdrawal. |
| activation.observations.v1 | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeDeduplicates optional browser analytics for learning activation. Separate from essential API receipt acknowledgments. | First or third partyFirst party | DurationBrowser tab session, at most 500 entries. Removed on analytics withdrawal. |
| tx-agent-kit.auth-token | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeKeeps the current adult or learner signed in within one browser tab. | First or third partyFirst party | DurationBrowser tab session. Removed on sign-out. |
| trace-learn.learner-session-mode | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeMarks a learner tab so it cannot silently restore an adult session. | First or third partyFirst party | DurationBrowser tab session. Removed on sign-out. |
| tx-agent-kit.refresh-token | TechnologyHttpOnly, Secure, SameSite=Lax cookie | ProviderSmart Cub Learning API | PurposeRenews an adult session without exposing the refresh credential to browser scripts. | First or third partyFirst party, same-site API | DurationPersistent for up to 30 days. Rotated during refresh and cleared on sign-out or learner login. |
| tx-agent-kit.auth-refresh-lock | TechnologylocalStorage | ProviderSmart Cub Learning | PurposePrevents several open tabs from refreshing the same adult session at once. | First or third partyFirst party | DurationNormally removed immediately. Its record expires after 10 seconds; a stale record is discarded on the next refresh attempt. |
| tx-agent-kit.google-auth.next-path | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeKeeps a safe internal return path while an adult signs in through Google. | First or third partyFirst party | DurationRemoved when the Google callback consumes it. An abandoned flow can leave it until the next callback or browser-data clear. |
| trace-learn:last-runtime-result | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeCarries the latest assessment result summary to the results screen in the current tab. | First or third partyFirst party | DurationBrowser tab session, or until overwritten. |
| trace_learn_events_<session-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeTemporarily preserves pseudonymous learning telemetry when a delivery attempt fails, so events are not silently lost. | First or third partyFirst party | DurationUp to 3 days and at most 12 sessions. Expired entries are pruned on a later telemetry write. |
| sidebar:open | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemembers whether an adult application sidebar is expanded or collapsed. | First or third partyFirst party | DurationPersistent until changed or browser data is cleared. |
| tracelearn:vite-dynamic-import-reload | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeRecords that the page has already reloaded once after a failed code download, so it does not reload in a loop. | First or third partyFirst party | DurationBrowser tab session. |
| trace-learn.active-learner-session | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeRemembers which learner session is open in this tab when an adult switches to a child account. | First or third partyFirst party | DurationBrowser tab session. Removed on sign-out or account switch. |
| trace-learn.pending-learner-handoff | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeHolds a short marker while an adult hands the device to a learner, until the hand-over is acknowledged. | First or third partyFirst party | DurationBrowser tab session, removed once the hand-over is acknowledged. |
| trace-learn.learner-core-return-path | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeRemembers the page a learner was on while a linked parent completes a Standard subscription checkout, so they return to it. | First or third partyFirst party | DurationBrowser tab session. Removed after the return. |
| learn.resume.<learner-id> | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeRemembers the lesson a learner was last in so the Learn page can offer to resume it. | First or third partyFirst party | DurationBrowser tab session. |
| tracelearn:public-11-plus:attempts | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeCounts practice attempts on public 11+ skill pages in this tab, to decide when to offer the free diagnostic. No learner record is created. | First or third partyFirst party | DurationBrowser tab session. |
| tracelearn_blog_cta_dismissed_v1 | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeRemembers that a visitor closed the sticky call-to-action on a guide. | First or third partyFirst party | DurationBrowser tab session. |
| trace-learn:qa-traffic | TechnologysessionStorage | ProviderSmart Cub Learning | PurposeMarks internal test traffic so it is excluded from analytics. Set only when a test link is used. | First or third partyFirst party | DurationBrowser tab session. |
| trace-learn.lesson-progress.<instance-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeKeeps an unsaved copy of a lesson in progress so a refresh does not lose the place. | First or third partyFirst party | DurationUp to 24 hours. Removed when the lesson is saved. |
| trace-learn:anonymous-diagnostic-funnel | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeLets a visitor resume the free diagnostic on the same device. | First or third partyFirst party | DurationUntil the saved diagnostic expires, finishes or is discarded. |
| trace-learn:anonymous-diagnostic-referral | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemembers a tutor invitation link so a diagnostic taken later can be linked to that tutor. | First or third partyFirst party | DurationUp to 28 days. |
| trace-learn.support.floating-help-visible.v1 | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemembers whether the floating help button is shown. | First or third partyFirst party | DurationPersistent until changed or browser data is cleared. |
| trace-learn:celebration-muted, trace-learn:public-quiz-sound-muted | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemember whether lesson and quiz sound effects are muted. | First or third partyFirst party | DurationPersistent until changed or browser data is cleared. |
| trace-learn:game-best:<game-id>:<student-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeKeeps a best score in a game only on the device it was played on. It is never sent to us. | First or third partyFirst party | DurationPersistent until browser data is cleared. |
| trace-learn.game-spend-queue.<student-id>.<game-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeHolds game-time use that has not yet reached the server, so no time is lost if the connection drops. | First or third partyFirst party | DurationUntil sent to the server. |
| smart-cub:tutor-demo:v1:<user-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeKeeps the changes a tutor makes to the sample students in the demo workspace. | First or third partyFirst party | DurationPersistent until browser data is cleared. |
| tutor.getting-started.v1.<user-id> | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemembers which getting-started steps a tutor has finished or dismissed. | First or third partyFirst party | DurationPersistent until browser data is cleared. |
| tracelearn_blog_cta_variant_v1 | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeOptional. Remembers which version of the guide call-to-action a visitor was shown, so it stays the same on later visits. Stored only after analytics permission; without it the version is chosen for each page view and nothing is stored. | First or third partyFirst party | DurationUntil analytics permission is withdrawn or browser data is cleared. |
| _ga | TechnologyCookie | ProviderGoogle Analytics | PurposeDistinguishes browsers for aggregate usage measurement on public marketing pages. | First or third partyFirst-party cookie set by Google on smartcublearning.com | DurationPersistent, up to 2 years by default, subject to browser limits. |
| _ga_J4BCXH23KD | TechnologyCookie | ProviderGoogle Analytics | PurposeMaintains session state for the Smart Cub Learning GA4 stream on public marketing pages. | First or third partyFirst-party cookie set by Google on smartcublearning.com | DurationPersistent, up to 2 years by default, subject to browser limits. |
| _gcl_* | TechnologyCookie | ProviderGoogle tag | PurposePreserves a consented advertising click so an adult acquisition outcome can be attributed, and lets Google Ads show relevant Smart Cub Learning ads to the adult visitor on other sites. | First or third partyFirst-party cookie set by Google on smartcublearning.com | DurationPersistent, normally up to 90 days, subject to browser limits. |
| _fbp, _fbc | TechnologyCookie | ProviderMeta pixel | PurposeWith advertising consent, identifies the adult visitor’s browser and consented Meta click so a diagnostic, sign-up, trial or first payment can be attributed and relevant Smart Cub Learning ads can be shown on Facebook and Instagram. | First or third partyFirst-party cookie set by Meta on smartcublearning.com | DurationPersistent, normally up to 90 days, subject to browser limits. |
| _rdt_uuid | TechnologyCookie | ProviderReddit pixel | PurposeWith advertising consent, identifies the adult visitor’s browser and consented Reddit click for attribution and relevant Smart Cub Learning ads on Reddit. | First or third partyFirst-party cookie set by Reddit on smartcublearning.com | DurationPersistent, normally up to 90 days, subject to browser limits. |
| __oppref | TechnologyCookie | ProviderOpenAI | PurposeSet by the ChatGPT ads measurement pixel to persist the oppref attribution identifier so a consented ad visit can be connected to an adult conversion. | First or third partyFirst-party cookie set by OpenAI on smartcublearning.com | DurationPersistent, normally up to 90 days, subject to browser limits. |
| _uetsid, _uetvid | TechnologyCookie | ProviderMicrosoft Advertising (UET) | PurposeWith advertising consent, identifies the adult visitor’s session and browser so consented Microsoft clicks can be attributed and relevant Smart Cub Learning ads shown on Bing and partner sites. | First or third partyFirst-party cookie set by Microsoft on smartcublearning.com | DurationSession (_uetsid) and up to 13 months (_uetvid), subject to browser limits. |
| _ttp, _tt_enable_cookie | TechnologyCookie | ProviderTikTok pixel | PurposeWith advertising consent, identifies the adult visitor’s browser so relevant Smart Cub Learning ads can be shown on TikTok. | First or third partyFirst-party cookie set by TikTok on smartcublearning.com | DurationPersistent, normally up to 13 months, subject to browser limits. |
| tracelearn_marketing_attribution_pending_v1 | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeHolds a consented campaign attribution payload until the Smart Cub Learning server has acknowledged it, so a flaky connection does not lose a consented click. Written only after consent; cleared on acknowledgement, on withdrawal, or after 7 days. | First or third partyFirst party | DurationUntil acknowledged, withdrawn, or 7 days. |
| tracelearn_marketing_consent_v1 | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeRemembers the adult visitor’s analytics and advertising measurement choices and the policy version used for that choice. | First or third partyFirst party | DurationPersistent until changed through Cookie settings, the policy version changes, or browser data is cleared. |
| tracelearn_marketing_consent_sync_pending_v1 | TechnologylocalStorage | ProviderSmart Cub Learning | PurposeMarks a consent choice whose server receipt still needs to be synchronized after a temporary connection failure. | First or third partyFirst party | DurationRemoved after the server confirms the choice, or when browser data is cleared. |
| tracelearn_marketing_consent_id | TechnologyHttpOnly, Secure, SameSite=Lax cookie | ProviderSmart Cub Learning API | PurposeLinks the browser to the server-side receipt that records the adult visitor’s current optional-storage choices. | First or third partyFirst party, same-site API | DurationPersistent for up to 365 days. Replaced when Cookie settings are changed. |
| tracelearn_attribution_id | TechnologyHttpOnly, Secure, SameSite=Lax cookie | ProviderSmart Cub Learning API | PurposeStores an opaque key that can link an allowlisted campaign touch to coarse diagnostic, report, trial, checkout, activation, or first-payment milestones. The cookie itself contains no click ID or learner data. | First or third partyFirst party, same-site API | DurationPersistent for up to 90 days. |
| Turnstile response token | TechnologyEphemeral widget token | ProviderCloudflare Turnstile | PurposeLets the API verify that a sign-up attempt passed the anti-bot check. | First or third partyThird-party security service | DurationUp to 5 minutes and single use. The application does not persist it in browser storage. |
| __stripe_mid | TechnologyCookie on Stripe-hosted Checkout | ProviderStripe | PurposeAssesses fraud risk for an attempted payment. | First or third partyProvider-hosted first-party cookie on checkout.stripe.com; Stripe is our third-party payment service | DurationPersistent for up to 1 year. |
| __stripe_sid | TechnologyCookie on Stripe-hosted Checkout | ProviderStripe | PurposeAssesses fraud risk during a payment session. | First or third partyProvider-hosted first-party cookie on checkout.stripe.com; Stripe is our third-party payment service | DurationPersistent for up to 30 minutes. |
| m | TechnologyCookie on m.stripe.com | ProviderStripe | PurposeHelps Stripe assess fraud risk for an attempted payment. | First or third partyProvider-hosted first-party cookie; Stripe is our third-party payment service | DurationPersistent for up to 2 years. |
3. Analytics, Turnstile, and Stripe caveats
PostHog is optional on site and product routes and starts only with current analytics permission. Its configured endpoint is in the EU. It measures use with adult account ID and email, or pseudonymous learner ID and role. Session replay, where enabled, masks text, inputs and attributes and blocks media and embedded frames. URL queries and fragments are removed. Withdrawal stops browser capture, discards pending browser analytics and clears this project's PostHog storage. Saved lessons and essential service receipts remain. A renewed choice is required for this policy version.
Google Tag Manager container GTM-53V6J33S loads on public marketing pages and provides the Smart Cub Learning GA4 stream. Advertising storage, and the Google Ads, Meta, Reddit, Microsoft and TikTok tags that depend on it, are enabled by default on adult acquisition routes. That setting also allows those networks to show relevant Smart Cub Learning ads to the adult on other sites. GTM, GA4 and every advertising tag stay off learner, parent, tutor, sign-in, sign-up, and token routes. Google documents _ga and _ga_<container-id> as GA4's first-party cookies, each with a default two-year expiry. Browser privacy controls can shorten that period. We do not send child names, email addresses, raw learner identifiers, answers, or diagnostic details to Google Analytics. See Google's GA4 cookie documentation.
When a public acquisition URL contains an allowlisted campaign value such as a Google or Microsoft click ID or a UTM parameter, the browser sends that value once to the Smart Cub Learning API. The API stores first-touch and last-touch records for up to 90 days and returns only an opaque HttpOnly cookie. Raw click IDs are not placed in localStorage, the analytics data layer, Stripe metadata, or learner records. If the visitor later creates a parent or tutor account, we can link coarse funnel milestones to that adult acquisition record. Provider events can say that a diagnostic was started or completed, a skill report was viewed, a trial started, checkout began, or a first payment succeeded. They do not contain the learner's identity, answers, score, skills, progress, or diagnostic result.
Our current managed Turnstile widget uses Cloudflare's default one-time token and has pre-clearance turned off, so it does not issue a cf_clearance cookie. Cloudflare can use necessary challenge state inside its hosted frame, but it does not expose a stable application-controlled storage key for us to name. Cloudflare documents the token as single-use with a five-minute lifetime. See the Turnstile integration documentation.
Smart Cub Learning redirects an adult to Stripe-hosted Checkout rather than embedding payment fields on our public pages. Stripe can set additional necessary storage depending on the payment method, Link use, fraud checks, location, and any required bank authentication. Stripe's live list is authoritative for its hosted pages. See Stripe Cookie settings.
4. What we do not use
- No advertising or remarketing cookies on any learner route.
- No advertising profile about a child: remarketing audiences describe the adult visitor's coarse funnel position only.
- No Google Analytics on learner, parent, tutor, sign-in, sign-up, or token routes.
- No learner names, identifiers, answers, scores, skills, progress, or diagnostic results in advertising attribution.
- No sale or sharing of browsing data.
5. Your choices
Optional analytics and advertising storage is enabled by default on adult acquisition routes. Use the persistent Cookie settings button to review or withdraw either purpose at any time. A withdrawal is sent to the API immediately so linked measurement and click identifiers are cleared. You can also clear cookies and site data in your browser settings. This signs you out, removes local preferences, and can remove a locally buffered learning session. Blocking essential storage may stop login, sign-up protection, or checkout from working. Browser settings and content-blocking controls can also restrict analytics and attribution storage. To object to public-site measurement or ask us to remove linked attribution data, contact the privacy address below.
6. Controller and contact
Just Understanding Data Ltd is a private limited company registered in England and Wales under company number 12472031. Registered office: Orchard House, Long Orchard Drive, Penn, High Wycombe, Buckinghamshire, HP10 8DD.
Questions about this policy? Email privacy@smartcublearning.com. See also our Privacy Policy and GDPR page.