Cookie Policy

A cookie is a small text file a website stores in your browser. It lets the site recognise your browser on the next request, which is how you stay signed in as you move between pages.

This policy also covers similar technologies with the same effect: local storage, session storage and pixel-free server logging. We use the word "cookies" for all of them.

We keep this deliberately small. We use the cookies needed to make the site work, one storage key that saves your progress through the application form, and aggregate usage measurement.

• We do not use advertising or retargeting cookies.
• We do not use cross-site tracking pixels or social media tracking widgets.
• We do not sell or share cookie data with data brokers.
• We do not build advertising profiles about you.

These are required for the site to function. They cannot be switched off through a consent banner, because without them you could not sign in or pay. They do not require consent under United States or EU rules.

Session cookie

Keeps you signed in to your learner account and identifies your session to our server. Set as HttpOnly and Secure so that scripts cannot read it. Expires when your session ends or you sign out.

Authentication state

Tells the page whether to render the signed-in or signed-out version of the header and navigation. Cleared on sign out.

Security and abuse prevention

Short-lived values used for request verification and rate limiting, so that forms cannot be submitted automatically at scale.

Load balancing

Set by our infrastructure to route your requests consistently. Expires at the end of the browsing session.

Application form progress

When you fill in the application form we save your answers, selected programme and payment plan into your browser’s session storage. It exists so that a refresh, an accidental back button or a cancelled payment does not lose your work. It never leaves your device until you submit the form, and it is cleared automatically once your application succeeds.

Interface preferences

Small values that remember interface state, such as a dismissed notice, so you are not shown the same thing repeatedly.

Session storage is cleared by your browser when you close the tab. You can also clear it at any time from your browser’s site data settings without affecting your account.

We measure aggregate usage so we know which programmes people look at and where the site is confusing. Analytics is grouped and reported at the aggregate level. We do not use it to build a profile of an individual learner, and we do not join it to your account.

Where consent is required in your jurisdiction, analytics is only enabled after you give it, and withdrawing consent stops future collection.

When you go to checkout, Stripe sets its own cookies to process the payment and to detect fraud. These are set by Stripe under its own privacy policy and are necessary for a card payment to complete safely.

We never see your card number. It goes directly from your browser to Stripe.

Session cookies

Deleted when you close your browser or sign out. Most of our cookies are session cookies.

Persistent cookies

Remain until they expire or you delete them. We keep persistent cookie lifetimes to 12 months or less.

Session storage

Cleared by the browser when the tab is closed.

• Every major browser lets you block or delete cookies in its privacy settings, either for all sites or for ours specifically.
• Blocking strictly necessary cookies will stop you signing in, saving progress or completing a payment. The rest of the site remains readable.
• Clearing site data signs you out and discards any saved application form progress.
• We honour the Global Privacy Control signal. If your browser sends it, we treat it as an opt-out of any sale or sharing of personal information.
• Browser Do Not Track signals have no agreed standard, so we do not respond to them separately. Global Privacy Control is the signal we act on.

If we add a new cookie category, we update this page and the date at the top before the cookie goes live. Adding anything in the advertising category would require your consent first.