Cookie Policy
This site sets no cookies. It uses one item of browser storage, only after you sign in, and only to keep you signed in. That is why there is no consent banner — the reasoning is set out in full below rather than asserted.
We set no cookies
Not “no third-party cookies”, and not “only essential cookies”. There is no Set-Cookie header anywhere on this site and no script that writes one. If you inspect your browser's cookie store after visiting, you will find nothing from us.
The one thing we do store on your device
When you sign in to manage an academic licence, we keep a single entry in your browser's local storage, under the name rx.session. It holds the session token the server issued, when it expires, and your name and email address so the page can greet you without asking the server again.
The session lasts 12 hours and the server refuses it after that. Signing out deletes the entry immediately and tells the server to destroy the session at its end too.
Nothing else is written to your device by this site. No preferences, no analytics identifier, no advertising identifier.
Why there is no consent banner
Because nothing here needs your consent, and a banner asking for it would be theatre.
No United States law requires a consent dialogue before setting a cookie, and in any case we set none. The state privacy statutes are about selling and sharing personal information, and about tracking people across sites for advertising - we do neither, so there is nothing here to opt out of.
The one thing we do store, described above, exists only after you have asked to sign in and only so that you stay signed in. It is not used to recognise you anywhere else, and it holds nothing but your own session.
Our analytics store nothing on your device at all - see the next section - so there is no reading or writing to consent to there either.
If we ever add something that does need consent, we will ask for it properly, before it loads, and this page will say so.
Analytics, and why they are not tracking
The site counts page views, downloads, and how long a page was visible. It does that by sending the page path and a duration to our own server, which increases a counter.
No identifier is created, sent or stored. Nothing is written to your device. The server keeps one number per day per page per event and no record of any individual visit, which means we cannot tell a returning visitor from a new one and cannot follow anyone between pages. We gave that up on purpose: the alternative needs an identifier, an identifier needs consent, and consent needs a banner.
If your browser sends the Global Privacy Control or Do Not Track signal, the script sends nothing at all.
Our content delivery network separately writes an ordinary access log containing IP addresses, as any web server does. That is not device storage and is not analytics, but it is personal information, and the privacy policy describes it.
Third parties
There are none on this site. No analytics vendor, no tag manager, no advertising network, no embedded video, no social media widget, no comment system, and no third-party font.
That last one is deliberate and was a change: the site used to load its typeface from Google Fonts, which sends every visitor's IP address to Google before the page renders. Fonts are now served by your own operating system, so loading a page from us contacts nobody but us.
If you choose to donate, the donate link takes you to Stripe, which is a different company with its own cookies and its own privacy policy. That only happens if you click it.
The application
The desktop application is not a browser and has no cookies. It stores its settings, your licence file and your quiz progress in your own user profile, and sends none of it anywhere. The privacy policy describes the three things that do cross the network.