Cookies Policy

• Supabase authentication session cookies: sb-<project>-auth-token (which can be split into numbered parts) and sb-<project>-auth-token-code-verifier. They are first-party, HttpOnly cookies that keep you signed in and last up to about 400 days or until you sign out.
• Cloudflare Turnstile on public forms and on the sign-in, sign-up and password reset pages: a spam challenge that loads from Cloudflare and may set Cloudflare cookies (third-party, session or short-lived).
• Local storage key nll-cookie-consent-v2: stores your cookie choice and consent policy version so we do not keep asking on every page load.
• Short-lived (about two hours) first-party cookies that carry an invite or checkout token while you complete sign-up or enrolment: nll_free_grind_invite, nll_parent_invite, nll_enrollment_claim and nll_enrollment_checkout. They are HttpOnly and are not used for tracking.
• Local storage key theme: your light or dark theme preference, kept on your device until you clear it.

The Google Analytics 4 tag is not loaded until you choose Accept analytics (or Accept analytics and ads). Before that, or if you choose Necessary only, no Google Analytics request is made and no analytics cookies are set. If you later withdraw consent in Cookie settings, the tag is switched off for the rest of your visit and is not loaded on later visits. After you accept analytics, it helps us see which public pages are used. Google Analytics 4 does not store IP addresses, although Google uses your IP address to work out your approximate location. Typical GA cookies are _ga and _ga_<measurement ID>, first-party cookies that last up to two years. If you choose analytics or ads, campaign details from the page address (UTM values, landing page, referring website) are saved in local storage under nll-attribution-v1 for up to 30 days, so we can see which ads or links led to an enquiry; if you have not chosen, nothing is saved. Linking GA4 data to Google Ads for audience building or ads performance measurement happens only when you have also chosen Accept analytics and ads (see section 3.3). We do not send student portal educational records to Google for advertising.

Advertising tags load only after you choose Accept analytics and ads. You can allow analytics without ads.

Meta Pixel records page views, page-view content events and lead events on public marketing pages when ads consent is on. Typical Meta cookies are _fbp and _fbc, first-party cookies that last about 90 days. When you submit an enquiry, or later pay for an enrolment, our server may also send Meta a matching lead or enrolment event containing only technical identifiers (those cookie values, IP address, browser type) and, for enrolments, the amount paid, never your name, email or phone, and only if you chose Accept analytics and ads. Meta may use this data for its own purposes under its own policy.

The Google Ads tag, when we use it, loads only after you choose Accept analytics and ads. We send Google consent signals (ad storage, analytics storage, ad user data and ad personalisation) so nothing is stored or personalised unless you agree. Conversion measurement sends the form name and plan or subject of interest only, never your name, email or phone. We also keep campaign details (utm parameters) and, only with ads consent, the gclid click identifier with the enquiry so we can tell which ads worked.

Google Ads and related Google advertising cookies may include _gcl_au, _gcl_aw, _gcl_gb, _gcl_ag, _gcl_dc, gclid, and similar click or conversion identifiers, which last up to about 90 days (names and durations can change; treat Google’s documentation as authoritative). With Google Consent Mode, when Analytics + Ads consent is active, Google Analytics 4 data may be linked to Google Ads for audience building and performance measurement. We do not send hashed emails or phone numbers to Google or Meta.

We do not use educational records, student portal activity, or logged-in app learning data for advertising profiling, audience building, or behavioural ad targeting.