Five things are set because the product cannot work without them: your Supabase auth session, an anonymous pre-signup session, and three local-storage keys holding your theme, your timer and your own cookie choice.
One thing is optional — PostHog, for product analytics and masked session replay. The masking excludes your attempts, the tutor’s replies, your recall answers and your explain-back text. Decline it in the banner, set Do-Not-Track, or email us and we will exclude your account server-side.
Nothing here is for advertising. No ad cookies, no cross-site tracking, no fingerprinting, no Meta or Google or TikTok pixel, and nothing sold to anyone.
a summary, not the agreement — the clauses below are what binds
Strictly necessary (always on)
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-* | Cookie | Supabase authentication session | 1 hour access; 7 days refresh |
bb_session | Cookie (httpOnly) | Anonymous session for pre-signup usage | 30 days |
bb-theme | Local storage | Day/night desk preference | Until cleared |
bb-pomo | Local storage | Pomodoro timer state | Until cleared |
bb-cookie-choice | Local storage | Your cookie-banner preference | Until cleared |
Analytics (optional)
| Name | Type | Purpose | Provider |
|---|---|---|---|
ph_* | Cookie + local storage | Product analytics + masked session replay | PostHog Inc. (US) |
Replay masks any element marked with data-ph-mask. Student attempts, tutor replies, recall answers, and explain-back text are excluded.
What we do NOT use
- Advertising cookies of any kind.
- Cross-site tracking or fingerprinting.
- Facebook Pixel, Google Analytics, TikTok Pixel, LinkedIn Insight, or similar.
- Data brokerage.
Opting out
- Click “Only strictly necessary” in the cookie banner.
- Set your browser’s Do-Not-Track — PostHog respects it.
- Set
window.__brainback_no_analytics = truein your browser console. - Email brainback@stratosync.solutions and we’ll exclude your account server-side.
Jurisdiction notes
Canada: withdraw consent any time via the methods above.
EU/UK: cookie banner on first visit with granular opt-out.
California: we do not sell or share personal information. No “Do Not Sell” link needed.