01In short
We set essential cookies to run the site. With your consent, and only then, we also use our own visit counts, Google Analytics to understand how the site is used and which adverts work. You choose in the cookie banner, and can change your mind at any time with Cookie settings at the bottom of every page. These tools run only on the public website, sign-up and checkout: never on study, test or results pages, and never for a student under 18.
02Cookies we set only with your consent
| Name | Kind | Why | How long |
|---|---|---|---|
| nk_vid | Analytics | A random identifier for this browser, so our own visit counts can tell one visitor from many page views. Holds nothing about you. | 13 months |
| _ga, _ga_* | Analytics · Google Analytics | Google Analytics counts visits and where they came from, for us. Google processes this data as described in its own privacy policy. | Up to 2 years |
03Every cookie we set
| Name | Why | How long |
|---|---|---|
| authjs.session-token | Keeps you signed in. Encrypted; holds no readable personal data. | 30 days, renewed as you use the site |
| authjs.csrf-token | Protects sign-in forms from being submitted by another site. | Until you close the browser |
| authjs.callback-url | Remembers which page to return you to after signing in. | Until you close the browser |
| device_id | A random identifier for this browser, so we can email you when your account is used from a new one. | 400 days |
| theme | Remembers light or dark mode, if you chose one. | 400 days |
| nk_consent | Remembers your answer to the cookie banner, so it is not asked on every page. Set only while any optional cookie is in use. | 180 days |
| nk_signup | While you sign up, points to the steps you have already filled in, so you can go back and forward. Only sent to the sign-up pages. | One day, or until the account is created |
| Service worker (browser storage) | Only if you turn on push notifications: lets your browser show them and open the right page. It stores no personal data and caches nothing. | Until you turn notifications off or clear site data |
On the live site, the sign-in cookies’ names begin with __Secure- or __Host-, which tells the browser to send them only over HTTPS.
04Browser storage
The site also keeps a few things in your browser’s local storage: that you have dismissed the cookie notice; which menu groups you folded in the student portal; and, during a test, any answers not yet saved to our servers, so a dropped connection or a closed tab loses nothing — they are sent the next time the paper opens and then removed. Nothing here is read by anyone else.
05Offer emails
This is not a cookie, but it is the one place we measure: if you are an adult and switched on offer emails, each one carries a one-pixel image that tells us it was opened, and its links pass through our site so we know which were followed. No other email we send does this, and nothing sent to a student under 18 ever does. Switching offers off in your settings stops it. The privacy notice has the detail.
06Your choices
You can delete or block cookies in your browser’s settings. If you block the sign-in cookies, you will not be able to sign in. More about how we handle data is in the privacy notice.