Cookie Policy

wos_session — first-party, HttpOnly, Secure in production and SameSite=Lax; authenticates your WorkOS session. It is a browser-session cookie and the sealed authentication session also has its own server-enforced expiry.

NEXT_LOCALE — first-party, SameSite=Lax; stores your selected interface language for 12 months.

Security providers may process request identifiers necessary to detect abuse, but the application does not deliberately set a separate advertising or security-tracking cookie. Strictly necessary technologies are based on providing the requested service and security, not consent.

PostHog — product analytics. The client is configured with memory-only persistence, no autocapture and no automatic pageviews, so it does not deliberately write a PostHog browser cookie or local-storage identifier. Allowlisted events may use the internal member ID. Optional session replay is disabled unless separately configured and, when enabled, masks all inputs and page text. Legal basis: consent.

Sentry — error and performance diagnostics, not advertising analytics. Session replay is disabled. A request scrubber removes query strings, cookies, headers and request bodies and retains only an internal user ID; exception text and other diagnostic context may still be processed where an error includes it. Legal basis: our legitimate interest in securing and diagnosing the Service; you may object through the Privacy requests page.

You can change your consent choices at any time through the cookie controls on the site, and you can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the Service from working.

Questions: privacy@cbam.school.