Cookies and browser storage
العربيةWhat we store on your device and how to change your choices.
Updated 8 October 2026
This notice explains the cookies and similar technologies (such as browser local storage and session storage) that CtrlAltRevise uses, and your choices. It sits alongside our Privacy Policy, which explains how we handle the personal data those technologies may involve. The storage described here supports the features you use and the choices you make.
What we use
The tables below describe the main cookies and browser storage used by the Platform.
Sign-in, security and your choices
These are required for the Platform to work — mainly to sign you in and keep your session secure, and to remember your cookie choice. Blocking authentication cookies prevents sign-in; rejecting optional analytics does not.
| What | Type | Purpose | Roughly how long |
|---|---|---|---|
| Authentication session cookie | Cookie (HTTP-only, set by our app via Auth.js) | Keeps you signed in to your account | Session / until you sign out or it expires |
| CSRF / sign-in flow cookies | Cookie (HTTP-only, set by Auth.js) | Protects the sign-in process against cross-site request forgery and carries the callback URL during sign-in | Short-lived, used during authentication |
| ctrlaltrevise_consent_v2 / ctrlaltrevise:analytics-consent:v2 | Cookie and local storage | Remembers your analytics choice, including rejection. | Cookie: one year. Local storage: until cleared or changed. |
The authentication cookie names are set by the Auth.js library and depend on your connection: on secure (HTTPS) connections they carry a __Secure- or __Host- prefix. We do not rename or repurpose them.
Optional analytics — browser storage
PostHog loads only after you choose Accept allin the banner or Allow analytics below. It uses local storage to remember an analytics identifier and session state so we can understand feature usage, performance and errors. A sample of consented sessions includes interaction replays showing on-screen text and public images. Input values, request bodies, console logs, canvas content, and code editors are excluded.
| Key | Purpose |
|---|---|
| ctrlaltrevise:analytics-auth:v2 | Session storage: consented sign-in method and completion state for up to 30 minutes; contains no credentials. |
| ctrlaltrevise:analytics-identity-changed | Local storage: timestamp signaling sign-out to other tabs; contains no account identifier. |
| ph_<project-token>_posthog | PostHog analytics identity, session, and attribution state; created only after consent. |
Session recordings are configured for 30-day retention. Event data may remain beyond 12 months because automatic enforcement of the configured event-retention period is not enabled. Withdrawing analytics permission stops new collection; it does not automatically erase data already sent. See Privacy Policy sections 8–9 for retention and deletion requests.
You can send a lesson rating without allowing analytics. If analytics is enabled, a separate lesson-rating event helps us measure feedback. Refusing analytics does not stop your feedback from reaching us.
Notification inbox records are not cookies
When we create an in-app notification, our database records that it was delivered and may record when you mark it read or dismiss it. Those records are operational account state: they keep your inbox consistent across devices and let us confirm that an important service notice was made available. They are not cookies or browser storage, are not sent to PostHog, and do not depend on analytics consent.
Opening a notification always works. We record a separate clicked engagement timestamp and send the notification-click analytics event only when you have allowed optional analytics. Rejecting or withdrawing analytics stops new click-engagement analytics without affecting delivery, read, or dismiss state.
Functional — browser local storage
These values are written to your browser's localStorage to remember preferences and requested learning work across visits. These local copies do not track you across unrelated websites. Some learning work is also saved separately to your account, as explained in our Privacy Policy. Deleting browser storage does not delete those server records.
| Key | Purpose |
|---|---|
| car-theme | Remembers your light or dark theme choice |
| car-accent | Remembers your accent colour |
| car-pseudocode-editor-theme | Remembers your code-editor colour theme (light, dark, Dracula, high-contrast) |
| car-pseudocode-layout | Remembers the panel size proportions in the pseudocode workspace |
| ctrlaltrevise:dashboard-layout:v1 | Remembers the order and visibility of widgets on your dashboard |
| ctrlaltrevise:learn-topics-width:v1 | Remembers the width of the topics sidebar in Learn |
Functional — browser session storage
These values are written to your browser's sessionStorage. They last only for the current browser tab and are deleted automatically when you close the tab, unless your browser restores the session. Some work is also saved separately to your account.
| Key | Purpose |
|---|---|
| quiz-state:<question-slugs> | Preserves your answer selections during an active quiz session so that a page refresh does not lose your progress |
Learning drafts and account isolation
These functional stores support saving and restoring work you request. Local storage has no automatic expiry; session storage lasts for the tab (and may survive browser session restoration).
| Key family | Purpose and scope |
|---|---|
| car.practiceBank.* | Local answer drafts, self-checked marking points and legacy progress flags, by question and part. |
| cslp:workspace:code:v2:* / cslp:scenario-studio:v1:* | Local pseudocode drafts, by account/workspace or scenario. Older draft-key versions are also cleared. |
| learn-completed-lessons:v1:* | Local completion reminders, by learner and qualification. Server progress remains authoritative. |
| lesson-feedback-submitted-* | Local flags remembering that feedback was sent for a lesson; these do not contain feedback text. |
| quiz-state:* / structured-response:v1:* | Session quiz selections and written response drafts, submissions and reflections. Written responses include learner, qualification, question and version in their key. |
| ctrlaltrevise:browser-account:v1 | Local and session account ID plus a random session marker to prevent another account or an old tab restoring your work. On sign-out the local marker no longer contains an account ID. |
| car:auth:lastEmail | Session email handoff from sign-in to password recovery. The former local car:auth:rememberEmail value is removed. |
| ctrlaltrevise.parentInviteToken | Session parent-invitation token retained during the sign-in handoff and removed after acceptance or rejection. |
Signing out or successfully deleting your account clears personal drafts, local learning state and sign-in handoffs in this browser. Opening learning features as a different account also discards the previous account's copies. Previously unassigned legacy drafts are discarded on the first account visit after this change. Old open tabs are prevented from restoring or rewriting those drafts and are sent back to sign-in when they observe the account change.
Appearance preferences and your analytics choice stay in place. Browser cleanup cannot reach another device, another browser profile, a closed tab's restored session, downloaded exports or backups. A different account cannot restore the old drafts through the app; use browser settings to remove copies from other devices.
Other appearance and tour preferences
car-accent-vars caches your custom accent colours; lpTheme is a legacy theme value migrated on use. cslp:workspace:reference-open:* remembers whether the pseudocode reference is expanded. car.tour.v1 and car.tour.mode remember the tour step and mode; car.tour.nav is a short session handoff removed on arrival. These contain presentation state, not your answers or code, and remain on sign-out. Other local appearance preferences listed above have no automatic expiry.
Account deletion verification cookie
account-deletion-proof is an HttpOnly security cookie set only when you request provider verification for account deletion. The cookie lasts up to 15 minutes; the server proof has a five-minute validity window and is consumed once. This verifies a fresh linked-provider sign-in, not age or guardianship.
Third-party providers
When you take a payment action we use Paddle or Stripe, and when you choose social sign-in we use Google or Apple. Those providers may set their own cookies on their own pages as part of completing that action; their use is governed by their own cookie/privacy policies. If you allow analytics, PostHog processes the limited analytics data described below in its EU cloud region.
Analytics and advertising
We use PostHog for optional product analytics, performance measurements, sanitized error reports and sampled interaction replays that can show on-screen text. It does not load until you actively allow analytics in our consent banner. Rejecting it does not affect the Platform. We do not use analytics for advertising or track you across unrelated websites.
We send page routes with dynamic identifiers removed, feature events without answers or code, browser/device details, acquisition labels, and normalized error categories. Signed-in analytics identifies your account by its internal ID; replays may still show names or email addresses displayed on screen. When signed in, we also save your choice and campaign labels to measure verified signup, trial and first subscription payment outcomes. These outcomes can arrive after you close the page. This analytics choice does not give permission for marketing email. You can change your choice at any time. Accept all enables optional analytics; Reject all keeps it off. Withdrawing consent stops browser collection immediately; while signed in, it also updates your account preference and cancels pending outcome reports after the change reaches our server. An event already being transmitted may complete. If offline or signed out, sign in again with analytics rejected to synchronize that choice:
Managing your stored data
You can delete or block cookies and clear local and session storage in your browser's settings, and use private/incognito browsing. Note:
- Blocking the strictly-necessary cookies will stop you from signing in.
- Clearing
localStoragewill reset your theme, accent colour, editor theme, workspace layout, dashboard layout, and Learn topics sidebar width to their defaults. - Clearing
sessionStorage(or closing the tab) will discard any unsaved quiz-answer progress for the current session.
Contact
Questions about this notice: ctrlaltrevise@gmail.com.
CtrlAltRevise operates as an individual sole trader from Compound Mivida, New Cairo City, Egypt. Privacy Policy sections 1 and 9 explain the operator and your rights.