Cookie Policy
This document is a draft.
It is still being reviewed by a lawyer and may change before it takes effect.
We do not show a cookie banner, and this is why
Library & Co. sets only the cookies that the service you ask for cannot work without: two that keep you signed in, one that finishes signing you in after you confirm your email, one that gives this browser a name so your devices can be told apart, and a few short-lived ones that exist only while you use Continue with Google. The device cookie is what lets a student account be used on one device at a time, and what lets you block a device you do not recognise. There is no analytics cookie, no advertising cookie and no third-party tracking cookie, so there is nothing here for you to accept or reject, and a banner asking you to choose would be offering a choice that does not exist.
Some things are also kept in your browser without being cookies: your light/dark choice, saved if you press the switch in the header, and your unfinished signup answers, kept while you fill in the signup form. Both are listed under “Browser storage that is not a cookie” below, and we store nothing else of that kind. Our fonts are served from our own servers, so loading a page does not tell a font provider that you visited.
The cookies we set
| Name | Purpose | Lasts |
|---|---|---|
sb-…-auth-token | Keeps you signed in. Split across numbered cookies when it is too large for one. | 400 days |
sb-…-auth-token-code-verifier | Used only while you are signing in or confirming your email, to complete the exchange securely. | 400 days |
__Host-ib_signup | Set only when you sign up. Lets this browser sign you in once you confirm your email address, even if you confirm it on another device. It holds a random value, works once, and is deleted when the check-your-email page signs you in, when you log out, or usually when you close your browser. Whatever happens, it stops working 24 hours after you sign up. | Until you close your browser (and it stops working after 24 hours) |
ib_device | Gives this browser a name — a random id, not your name and not linked to anything you do elsewhere. A student account can be signed in on one device at a time, and this is how the other one is recognised, and how you can block a device you do not recognise. Clearing it makes this browser look like a new device. | 730 days |
ib_google_oauth | Set only when you choose Continue with Google. Holds one-time values that protect that sign-in from forgery. Deleted when you come back, and expires after 10 minutes. | 10 minutes |
ib_signup_draft | Your signup answers, carried through Google so you do not retype them. Deleted when you finish signing in with Google, and expires after 15 minutes. | 15 minutes |
ib_signup_resume | If finishing your signup needs a correction after Google, your answers for that one page. Expires after 10 minutes. | 10 minutes |
Every cookie above is first-party — set by this site, not by anyone else — and strictly necessary for the thing you asked to do: stay signed in, finish signing up, use one device at a time, or sign in with Google. The Google ones are set only if you choose that button. We set no functional, analytics or marketing cookies.
The sign-in cookie lasts 400 days. We are telling you the real number rather than implying it disappears when you close the browser. If you are on a shared or school computer, sign out when you finish — that removes it.
Browser storage that is not a cookie
| Key | Purpose | Lasts |
|---|---|---|
ib-theme | Your light or dark choice, saved in your browser's local storage. It is written only when you press the switch in the header, it never leaves your browser, and clearing your site data removes it. | Until you clear site data |
ib-signup-draft:v1 | Your unfinished signup answers — never your email, password or the two consent ticks — kept only in this browser tab and gone when you close it. | Until you close the tab |
Other companies your browser contacts
Some things on the page load straight from another company's servers, which means your browser tells them your IP address and which file you asked for. They do not set cookies that we control:
- Bunny — course video and its thumbnails.
- Google — only if you choose Continue with Google: your browser goes to Google's own sign-in page, which Google runs and which sets its own cookies there. No Google script runs on our pages.
- Supabase — course cover images and teacher photographs, and the database and sign-in service behind the site.
This happens on public pages too, so it applies even before you have an account. Who these companies are and what they do with data is covered in the Privacy Policy.
Removing them
Signing out removes the sign-in cookie. The unfinished-signup answers disappear when you close the tab. You can also clear cookies for this site in your browser's settings at any time. Doing so signs you out — nothing else breaks, and no course, purchase or progress is lost. Clearing them also discards this browser's device name, so it will look like a new device the next time you sign in, and any block you had placed on it stops applying to it.