Cookie Policy

Effective: 2026-05-23 · Last updated: 2026-06-07

This policy explains what cookies we use on MLTPrep, why we use them, and how you can control them.

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the site to recognise your device on return visits and remember certain information (such as whether you are logged in). We also use similar technologies such as localStorage for storing your consent preference on the client side.

Cookies We Use

Category 1 — Strictly Necessary

These cookies are essential for the Platform to function. They cannot be disabled. No consent is required for these cookies under any jurisdiction.

Cookie / Token	Purpose	Duration
Supabase session token	Keeps you signed in between page loads	Session / 1 week (rolling)
mltprep-consent	Stores your cookie consent preferences	12 months
CSRF token	Protects form submissions from cross-site request forgery	Session

Category 2 — Functional

These cookies improve your experience but are not strictly required. They may be disabled without losing core functionality.

Cookie / Storage	Purpose	Duration
Exam state (localStorage)	Restores an interrupted exam session if your browser closes unexpectedly	Until exam completed or expired
Timezone preference	Displays exam timers and timestamps in your local timezone	12 months

Category 3 — Analytics

We may use anonymous analytics to understand how users interact with the Platform (e.g., which fields are most studied, where users drop off). No personally identifiable information is used in analytics. Analytics are only active if you have consented.

Provider	Purpose	Duration
Internal (Supabase logs)	Anonymous page view and feature usage counts	90 days

Category 4 — Marketing

We do not currently use any marketing or advertising cookies. If we add them in future, a separate explicit opt-in will be required and this policy will be updated.

How We Detect Your Location for the Consent Banner

On your first visit, we attempt to determine which privacy law applies to you using a three-step process:

IP address lookup — we query a geolocation service to map your IP address to a country and region. Your full IP is not stored by us beyond 30 days, after which it is hashed irreversibly.
Device timezone — if IP detection fails or returns an ambiguous result, we read your device's timezone setting (e.g., America/Toronto) to infer your likely region. This does not require any browser permission.
Browser language — as a final tiebreaker, we check your browser's configured language (e.g., en-GB). If no signal is found, we apply the strictest standard (GDPR) by default.

This detection is used solely to show you the appropriate consent banner. The detected jurisdiction is saved with your consent record for audit purposes.

Third-Party Cookies

Our payment processor (Dodo Payments) may set their own cookies on their hosted payment pages. Those cookies are governed by Dodo Payments' cookie policy. We do not control those cookies and they are not set on MLTPrep pages.

How to Manage Your Preferences

You can change your cookie preferences at any time in two ways:

Via the consent banner: Click "Manage Preferences" at the bottom of the page. If the banner is no longer visible, clear your cookies to trigger it again.
Via your account settings: Once logged in, go to Settings → Privacy to update your consent choices. Changes take effect immediately.
Via your browser: All modern browsers allow you to block or delete cookies in their settings. Note that disabling strictly necessary cookies will prevent you from staying signed in.

Retention and Deletion

Session cookies are deleted when you close your browser. Persistent cookies expire after the duration shown in the tables above. You may delete cookies at any time through your browser. Deleting the mltprep-consent cookie will cause the consent banner to re-appear on your next visit.

Changes to This Policy

If we add new cookie categories or change how existing cookies are used, we will update this page and increment the consent version. Registered users will be shown the updated banner and asked to re-consent.