Cookie Policy

• Koydo does not run advertising and does not use advertising cookies. Ever.
• We use a small number of strictly-necessary cookies for login and security. These cannot be disabled.
• We use a small number of functional cookies for accessibility, theme, and locale. You can disable them in settings.
• Optional analytics require recorded consent. Mixpanel is disabled in the current linked web configuration; Vercel analytics also require the eligibility checks described below.
• Known users under 18 and unresolved active profiles are blocked from optional analytics regardless of region or settings.
• Mobile apps (Flutter, native iOS Swift, native Android) do not use web cookies. Native consent is handled via Apple App Tracking Transparency (ATT) on iOS and Google's User Messaging Platform (UMP) on Android.

1.1 Strictly Necessary

| Cookie / storage key | Purpose | Provider | Retention | Type |

|---|---|---|---|---|

| sb-access-token, sb-refresh-token | Supabase authentication session | Supabase | Session + 1 hour refresh window | HTTP-only, Secure, SameSite=Lax |

| __cf_bm | Cloudflare bot management (network protection) | Cloudflare | 30 minutes | HTTP-only, Secure |

| __stripe_mid, __stripe_sid | Stripe checkout session integrity (only on checkout pages) | Stripe | 1 year / 30 minutes | HTTP-only, Secure |

| koydo-csrf-token | CSRF protection on state-changing requests | Koydo | Session | HTTP-only, Secure, SameSite=Strict |

| koydo-consent-state | Stores your consent choices for non-essential cookies | Koydo | 12 months | First-party, Secure |

These cookies cannot be disabled because the Service cannot function without them.

Cloudflare's Turnstile security check may also process network and browser/device signals, including an IP address, when it is shown. Koydo uses that processing to protect forms and accounts from automated abuse, not for advertising or optional product analytics.

1.2 Functional (consented or user-set)

| Storage key | Purpose | Provider | Retention | Type |

|---|---|---|---|---|

| koydo-locale | Your selected language | Koydo (localStorage) | Until cleared by user | First-party |

| koydo-theme | Your selected theme (light / dark / high-contrast) | Koydo (localStorage) | Until cleared | First-party |

| koydo-a11y-prefs | Accessibility preferences (font size, motion, dyslexic font) | Koydo (localStorage) | Until cleared | First-party |

| koydo-onboarding-state | Which onboarding steps you've completed | Koydo (localStorage) | Until cleared | First-party |

These are user-set preferences; they don't track you. You can clear them via your browser at any time.

1.3 Analytics (consented; blocked for users under 18 regardless of consent)

| Cookie | Purpose | Provider | Retention | Type | Gating |

|---|---|---|---|---|---|

| Mixpanel persistence (not active in the current linked configuration) | Optional product analytics if enabled later | Mixpanel | Provider/account setting when enabled | First-party | Requires a known adult active profile and consent; minor, unknown-age, opt-out, and native contexts are blocked |

| No Vercel cookie (script-based collection) | Aggregated page views and real-user performance metrics | Vercel | Reporting window depends on plan; the daily visitor hash is discarded after 24 hours | Cookie-free analytics | Active profiles known to be under 18 are blocked; anonymous use requires adult-mode selection and consent |

Optional analytics load only after analytics consent has been recorded. Do Not Track, Global Privacy Control, account settings, and parent opt-out controls can suppress collection.

1.4 Performance / Error Monitoring

| Storage key | Purpose | Provider | Retention | Type | Gating |

|---|---|---|---|---|---|

| Sentry in-memory event identifiers (not stored as a cookie) | Error monitoring with minimized crash metadata; automatic session tracking is disabled | Sentry | Event lifetime | Server-side | User identity, request data, learner content, breadcrumbs, custom context, attachments, replay, and performance traces are blocked at the source for every user |

1.5 Advertising

None. Koydo does not run advertising and does not use advertising cookies. This is a deliberate product decision and not subject to consent toggles because there is nothing to consent to.

2.1 EEA / UK / Switzerland

On your first visit, you'll see a consent banner with three options: Accept all, Reject non-essential, and Customize. Your choice is stored in koydo-consent-state and respected on every subsequent visit. You can change your choice anytime from the footer link "Manage Cookies" or in Account Settings → Privacy.

We do not use "dark patterns" — Reject is as easy as Accept; both are one click; both are equally prominent.

2.2 United States, Canada, and Other Regions

We do not require a banner under the laws of these regions, but we provide the same controls in Account Settings → Privacy. You can also use:

• The Global Privacy Control (GPC) browser signal — Koydo automatically interprets a GPC signal as opting out of analytics tracking.
• The "Do Not Sell or Share My Personal Information" link at /legal/do-not-sell (California, Colorado, Connecticut, and other states with opt-out rights).

2.3 Children Under 18

Mixpanel is currently disabled in the linked web configuration. Its code path requires an active profile with a known age of at least 18 and analytics consent; anonymous visitors, minors, and unresolved profiles are blocked. Vercel Web Analytics and Speed Insights are blocked for active profiles known to be under 18 and while active-profile age is unresolved. Anonymous visitors have no verified account age; optional Vercel analytics require both an adult-mode selection and analytics consent. Parent opt-out, Do Not Track, and Global Privacy Control remain independent deny signals.

Koydo's mobile applications do not use web cookies. Where mobile measurement or consent is relevant:

• iOS uses Apple's App Tracking Transparency (ATT) framework. The native iOS prompt is shown on first launch where applicable.
• Android uses Google's User Messaging Platform (UMP) for EEA / UK consent collection in app.
• For the legacy Matura Capacitor WebView shell, the web cookie banner is hidden when running inside the native shell (handled by body.koydo-embed-mode styling). Native consent is collected at the app level instead. Koydo is migrating away from WebView shells; new mobile apps are Flutter or native Swift only.

If you have questions about a specific cookie or storage key not listed here, contact privacy@koydo.app — we will respond within 30 days and update this inventory if necessary.

Cookies inventory v2026-05-09 — Effective May 9, 2026