Cookie Policy

1. Short version

• SmartKourse sets 2 browser storage items, and all of them are essential.
• There are no advertising, marketing, or third-party analytics cookies. None.
• There is no consent banner, because there is nothing non-essential to consent to.
• Embedded lesson video from YouTube is the one place a third party can set storage in your browser, and only if you interact with a player.

2. Why there is no “Accept all” banner

Consent banners exist so you can refuse tracking that is not necessary to deliver the service. When a site sets only strictly necessary storage, a banner asking you to “Accept all” is theater: there is no meaningful choice behind it, clicking it changes nothing, and it trains people to dismiss consent prompts without reading them. We would rather not add one.

So instead of a button that does nothing, this page is the disclosure. If we ever introduce analytics, advertising, or personalization storage that is not necessary to run the site, we will build a real consent control — one where declining actually prevents the storage — before turning it on. That commitment is in section 12.

3. Cookies vs. local storage

“Cookie” is the common term, but browsers offer several storage mechanisms and the privacy questions are the same for all of them. SmartKourse uses HttpOnly sk_access / sk_refresh cookies for authentication (not readable by JavaScript and not stored in localStorage), a readable CSRF cookie for double-submit protection, a non-sensitive sk_session_hint cookie so the static client can tell a session may exist, a language-preference cookie, and browser local/session storage only for non-auth items such as lesson progress and an optional display snapshot for the navbar.

Auth tokens are never written to localStorage. Clearing site data signs you out because the HttpOnly cookies are removed with the rest of the site’s storage.

4. Complete inventory

This list is generated from our shared configuration, so it cannot drift.

5. What each item does

• Language preference. Remembers the interface language you selected so the site does not reset to a default on every visit.
• HttpOnly access and refresh cookies. Prove to our API that you are signed in. JavaScript cannot read them. They are removed when you log out, when they expire, or when you clear site data.
• Readable CSRF cookie. Paired with a request header on mutating calls (double-submit). Not an authentication token by itself.
• Session hint cookie (sk_session_hint=1). A non-sensitive flag set on login/refresh and cleared on logout so the static client can decide whether to probe /session. Guests without this hint make zero session calls.

6. Our analytics, and why it is essential-tier

Production traffic measurement uses Vercel Analytics and Speed Insights, which ship with our hosting and are always-on as part of that platform. SmartKourse does not currently write first-party per-visit analytics records to PostgreSQL. There is no session recording, heatmaps, or cross-site ad tracker from SmartKourse.

We categorize hosting analytics as essential to operate and secure the platform. Cookie Settings only lists preferences that change SmartKourse runtime behavior; it does not control Vercel’s hosting metrics.

7. Third-party storage: embedded video and Stripe

YouTube. Lesson video is often delivered through embedded YouTube players supplied by instructors. We use privacy-enhanced embeds where available, which defer storage until you interact with the player. Once you press play, Google may set its own cookies and storage under its policies, which we do not control. Blocking third-party storage for those domains prevents it, though playback may also break.

Stripe. During checkout, Stripe’s hosted payment pages may set storage necessary to process the payment and prevent fraud. That happens on Stripe’s pages under Stripe’s policies. We do not set payment cookies ourselves and we never receive your card number.

8. What we do not use

Not present in the product today:

• Google OAuth (env placeholders only; not implemented in auth flows)
• Sentry or other APM
• Marketing email platforms
• Advertising / retargeting pixels
• Affiliate tracking networks

We also do not use fingerprinting, cross-device tracking, data brokers, or social media tracking pixels.

9. How to see, block, and clear this data

• Inspect it. Open your browser’s developer tools, go to the storage or application panel, and look at cookies and local storage for this site. Everything we set is listed in section 4 — you can verify our disclosure yourself, and we encourage that.
• Clear it. Use your browser’s “clear site data” or “clear cookies and site data” option for this domain. This logs you out.
• Log out. Signing out clears HttpOnly session cookies, the CSRF cookie, and the session-hint cookie.
• Block it. Browser settings and extensions can block cookies and local storage per site. Blocking our session cookies prevents sign-in from working.
• Private browsing. A private or incognito window discards all of it when you close the window.
• Block third-party storage to limit what embedded video providers can set.

10. What breaks if you clear it

Clearing this data is safe and nothing is lost permanently from your account, but be aware: you will be signed out and must log in again; your language preference resets to the default; and lesson progress markers stored in your browser are erased, so completed-lesson checkmarks and your last-viewed position may disappear. Your purchases and course access are stored on our servers and are unaffected.

11. Do Not Track and opt-out signals

There is no consistent industry standard for responding to Do Not Track, so we do not act on it specifically — but the practical effect you would want from it already holds, because we do not track you across sites or serve advertising. Global Privacy Control signals a request not to sell or share personal information; we do neither, so there is nothing for the signal to switch off. See the California Privacy Notice.

12. If we ever add non-essential storage

Before enabling anything beyond the essential items above, we commit to:

1. Updating this page to list the new item, its purpose, and its duration.
2. Building a genuine consent mechanism where declining actually prevents the storage from being set, rather than a banner that records a preference and proceeds anyway.
3. Defaulting non-essential storage to off until you affirmatively enable it.
4. Providing a way to change your mind later.

We will also update the Privacy Policy at the same time.

13. Contact

Questions about cookies and browser storage: Contact form on this website (email address pending owner configuration), or the contact form. If you find storage on this site that is not listed in section 4, please tell us — that would be a bug in either the code or this page, and we want to fix it.