Cookie Policy
Last updated: 2026-07-29
1. What cookies are
Cookies are small text files stored on your device when you visit a website. We use cookies and similar technologies (like local storage) to run the site, remember your preferences, and understand how the site is used.
2. The cookies we use
| Category | Purpose | Examples | How long | Can be disabled? |
|---|---|---|---|---|
| Strictly necessary | Required for the site to function — login sessions, checkout, security | Session/auth cookies; consent-region, which records only whether you're visiting from the EU/EEA/UK so we know which consent rules to apply | Session/auth cookies last for your sign-in; consent-region lasts 24 hours | No — these are essential and not subject to consent under GDPR/ePrivacy |
| Functional | Remember your preferences (e.g. language, in-progress test answers) and run the live-chat support widget | Preference cookies, Tidio live-chat cookies | Preferences persist until you clear them; Tidio's durations are set by Tidio | Yes |
| Analytics | Understand how visitors use the site, so we can improve it (PostHog) | A single ph_phc_…_posthog cookie, holding a randomly generated device and session ID plus the page you first arrived on and where you came from — no name, email, or test answers | 12 months | Yes |
| Payment | Set by Stripe during checkout for fraud prevention and to process your payment | Stripe cookies | Set by Stripe | No (required to complete purchase) — see Stripe's cookie policy |
PostHog also uses your browser's local storage, which holds the same identifiers as the cookie above along with its own settings — which features are switched on for you, and when your session last renewed. Local storage has no expiry date and is removed when you clear site data. Withdrawing analytics consent stops any further data being collected and resets the identifiers held there.
3. How consent works, depending on where you're visiting from
We apply different consent mechanisms depending on your location, since cookie law differs by region:
- Visitors in the EU/EEA and UK: Non-essential cookies (functional, analytics) are off by default. You'll see a consent banner on your first visit and must actively opt in before any non-essential cookie is set. You can withdraw consent at any time via the "Cookie Preferences" link in the site footer.
- Visitors elsewhere (including the US, outside California-specific rules below): Non-essential cookies may be set by default, with a clear option to opt out via the same "Cookie Preferences" link.
- California visitors: You have the right to opt out of the "sale or sharing" of personal information, including via analytics. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out request. We do not sell personal data in the traditional sense, but we treat analytics cookies as covered by this right out of caution.
Strictly necessary cookies are set regardless of location, since the site cannot function without them, and they don't require consent under any major cookie law.
4. Managing your preferences
You can change your cookie choices at any time via the Cookie Preferences link in the footer, or through your browser settings (which let you block or delete cookies generally — note this may affect site functionality).
5. Third-party cookies
Some cookies are set by services we use, not by us directly:
- Stripe (payments/fraud prevention) — see Stripe's cookie policy
- PostHog (analytics) — EU-hosted; loaded once you accept analytics cookies or, outside the EU/EEA/UK, by default; see PostHog's privacy policy
- Tidio (live-chat support) — powers the on-site chat widget (a functional cookie, loaded once you accept or, outside the EU/EEA/UK, by default); see Tidio's privacy policy
6. Changes
We'll update this page if the cookies we use change materially.