Cookie Policy
Last updated: 31 August 2026
1. What are cookies?
Cookies are small text files a website places on your device. They make websites work, remember your preferences, and sometimes tell the owner how the site is used. This policy explains which ones we use and why.
The short answer: we use one cookie that is needed to keep you signed in, we set no advertising cookies, and no request goes to any third party at all unless you consent to statistics.
2. Cookies we set
| Name | Purpose | Type | Duration |
|---|---|---|---|
refreshToken | Keeps you signed in. Strictly necessary — the service cannot work for signed-in users without it. Readable only by the server, not by scripts in the page. | Strictly necessary | 7 days, or 30 days with "Remember me" |
portal_token | Remembers a parent's access link during a visit to the parent portal, so the link does not have to sit in the address bar on every page. Strictly necessary for the portal. | Strictly necessary | the duration of the portal visit |
_ga, _ga_* | Set by Google Analytics to measure visitor numbers. Only set where statistics are enabled for this environment and you opt in through the cookie banner. | Statistics (consent) | up to 2 years |
Local storage
We also store data in your browser's localStorage. That is not a cookie but works similarly. None of it is sent to a third party:
lesson:root— your sign-in state and your settings in the app, so a second tab or a reload does not sign you out.cookie_consent— your choice in the cookie banner, so we do not show it again.analytics_consent— whether you consented to statistics, so we honour that on your next visit.jss:theme— your light or dark theme choice, applied before the page is painted.i18nextLng— your language choice.
3. Statistics and third parties
We use Google Analytics 4 (Google Ireland Limited) only where it is enabled for this environment. Where it is, it runs cookielessly by default: nothing is stored on your device and only anonymous, aggregate counting takes place. Only if you opt into statistics in the cookie banner are the _ga and _ga_* cookies set. Where analytics is not enabled, the banner does not offer that choice and no request is made to Google at all.
Google may also process that data outside the EEA. That transfer relies on the European Commission's Standard Contractual Clauses and Google's data processing terms. See Google's privacy policy.
Beyond that: we set no advertising cookies. Payment for your subscription runs on Mollie's own environment, which sets its own cookies under its own cookie notice. Our form spam protection (ALTCHA) runs on our own server, asks your browser to solve a small computation, and sets nothing. The fonts are served from our own server, so no third-party request is made for those either.
What does leave the EU is not a cookie but a processing operation: the AI assistance in progress reports. It is explained in clause 6 of the Privacy Policy.
4. Managing cookies
You can change your choice at any time:
You can also manage cookies through your browser:
Note: blocking the refreshToken cookie stops you staying signed in, and without portal_token the parent portal does not work.
5. Questions
Cookies and local storage are personal data as soon as they identify you, so this policy belongs with the Privacy Policy — read them together. Questions about either, or a request about your data: privacy@lesson-solutions.online.