Cookie Policy
Last Updated: September 2, 2026
1. Introduction
This Cookie Policy explains how Phayan (“we,” “us,” or “our”) uses cookies and similar technologies when you visit our website and use our services (collectively, the “Service”). This policy should be read together with our Privacy Policy.
2. What Are Cookies?
Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. They help websites remember your actions and preferences over time, so you don't have to keep re-entering them.
We also use similar technologies such as pixels (small invisible images used for analytics) and browser local/session storage.
3. Cookies and Storage We Use
3.1 Essential Cookies
These cookies are necessary for the Service to function properly. They enable core functionality such as authentication and security. The Service cannot function properly without these cookies, and they cannot be disabled.
| Name | Purpose | Duration |
|---|---|---|
accessToken | Keeps you signed in. Not readable by scripts (httpOnly); the cookie is set to last exactly as long as the sign-in token inside it. | 30 days |
_csrf | CSRF protection token to prevent cross-site request forgery attacks (httpOnly) | Session |
phayan_gdpr_region | Records whether your region requires GDPR cookie consent (used to determine if the cookie banner should be shown) | 30 days |
phayan_cookie_consent | Records that you have made a cookie consent choice (the actual preferences are stored in browser local storage) | 365 days |
phayan_opt_out_signal | Records that you have opted out of all optional tracking, set when you use the button on Your Privacy Choices, or automatically when your browser sends a Global Privacy Control signal | 365 days |
phayan_ui_prefs | Your theme and text size, so the first paint of a page is already the way you set it rather than flashing the default | 1 year |
3.2 Functional Storage
These items are stored in your browser's local or session storage to remember your preferences and improve your experience.
| Key | Purpose | Type / Duration |
|---|---|---|
phayan_cookie_consent | Stores your cookie consent preferences (necessary, analytics, functional) as JSON | Local storage (persistent) |
phayan-progress | Your learning progress before you sign in: levels completed, drill answers, and the review queue. Written first to your browser and merged into your account when you sign in. | Local storage (persistent) |
phayan-progress-sync | Where the merge got to, so an interrupted sync resumes instead of starting over | Local storage (persistent) |
phayan-learn-settings, phayan-learn-preferences, phayan-audio-off, phayan:assistPos | How you have set the lesson screen up: the options you chose, whether audio is muted, and where you dragged the helper | Local storage (persistent) |
phayan:deviceId, phayan:anonId, phayan:uid | Random identifiers that let two devices merge the same progress without conflict, and that keep the right person's cached progress on a shared computer. They are generated in your browser and mean nothing outside it. | Local storage (persistent) |
phayan_install_banner_dismissed, phayan_push_primer_decided | That you have already dismissed the “get the app” banner, or already answered the notifications question, so we stop asking | Local storage (persistent) |
phayan_notrack | Switches off every analytics and advertising tool for this browser. Set it by adding ?notrack=1 to any page address, and clear it with ?notrack=0. It works whatever your cookie choice was. | Local storage (persistent) |
3.3 Analytics Cookies
These cookies help us understand how visitors interact with our Service. PostHog is the one that currently runs; it is only set when you have given analytics consent (or are in a non-GDPR region). Google Analytics and the Meta Pixel are not currently configured, so their cookies below are not set for anyone yet — listed here so the table stays accurate the moment either is turned on.
| Cookie Name | Purpose | Duration |
|---|---|---|
_ga | Google Analytics 4: distinguishes unique visitors | 2 years |
_ga_* | Google Analytics 4: maintains session state | 2 years |
_fbp | Meta Pixel: identifies browsers for ad delivery and analytics | 3 months |
_fbc | Meta Pixel: stores click identifier when arriving from a Facebook ad | 3 months |
ph_*_posthog | PostHog: the identifier that links your page views into one visit, stored as both a cookie and a local storage entry. Until you allow analytics — and permanently, if you decline — it is held in memory only and disappears when you close the tab. | 1 year |
3.4 Marketing Cookies
These cookies are used to measure advertising effectiveness and deliver relevant ads, when the underlying tool is configured. They would only be set once you have given analytics consent. Google Ads is not currently configured, so this cookie is not set for anyone yet.
| Cookie Name | Purpose | Duration |
|---|---|---|
_gcl_au | Google Ads: stores conversion data for ad clicks | 3 months |
4. Third-Party Services
The following third-party services may set their own cookies or collect data when you use the Service. We do not control these cookies.
| Service | Purpose | Privacy Policy |
|---|---|---|
| PostHog | Product analytics and, for signed-in users who allow it, session replay. The one analytics tool that currently runs. | View |
| Google Analytics 4 | Website usage analytics and traffic analysis, when configured. Not currently configured. | View |
| Google Ads | Conversion tracking for advertising campaigns, when configured. Not currently configured. | View |
| Meta Pixel | Advertising analytics and conversion tracking for Meta (Facebook/Instagram) campaigns, when configured. The browser pixel is not currently configured. A separate server-side event to Meta on sign-up and on purchase, when configured, runs regardless of any of the above. See the Privacy Policy, section 2.2, for what it collects. | View |
| Google reCAPTCHA v3 | Invisible spam and bot prevention during login and registration | View |
| Stripe | Secure payment processing for subscriptions (checkout and billing portal are hosted by Stripe) | View |
| Sentry | Error monitoring and performance tracking to help us fix bugs | View |
4a. Tracking in Emails
Our email provider reports back to us whether each message was delivered, opened, clicked, bounced, or reported as spam, and we keep that against your account. Open tracking works by loading an image, so turning images off in your email program defeats it. Every message about Phayan also carries a one-click unsubscribe your mail program can offer as a button, and an unsubscribe link in the message itself.
5. Local Progress Storage
Before you sign in, your learning progress is stored locally in your browser (via local storage, not cookies). This lets the lessons work with zero auth: completed rounds, drill answers, and the review queue live on your device until you sign in.
When you sign in, this local progress merges with your account; the merge is per-round and keeps the highest completion state on each item. Clearing your browser data removes the local copy; your signed-in progress remains on your account.
6. How We Use Cookies
We use cookies and similar technologies for the following purposes:
- Authentication: To keep you signed in across sessions
- Security: To protect against CSRF attacks and bot abuse
- Consent: To remember your cookie preferences and GDPR region
- Analytics: To understand how the Service is used and identify areas for improvement
- Advertising: To measure the effectiveness of our advertising campaigns
7. Your Cookie Choices
7.1 Cookie Consent Banner
If you are in the EEA, UK, or Switzerland, we show a cookie consent banner on your first visit, and nothing optional loads until you answer it. You can change your answer at any time on the Cookie Preferences page.
Elsewhere we do not show the banner, and analytics and advertising cookies are switched on. That is the law where you are rather than a judgement about you: you can switch them off on the Cookie Preferences page, on Your Privacy Choices, or by turning on Global Privacy Control in your browser, which we honour everywhere. If we cannot tell which region you are in, we treat you as if you were in the EEA and ask.
In the iOS and Android apps there is no banner, and optional cookies stay off unless you have already allowed them. Nothing switches them on for you.
Google Analytics, Google Ads, and the Meta Pixel are not currently configured, so none of them tracks you today regardless of your choice here. The wiring for all three is already in place for when that changes: Google Analytics and Google Ads would run under Google Consent Mode v2, which respects your consent choice and, when consent is denied, sends Google only a cookieless ping for conversion modeling — no cookies, no personal data. The Meta Pixel would likewise track only once you grant analytics consent.
7.2 Browser Settings
You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, if you block essential cookies, you may not be able to sign in or use core features of the Service.
7.3 Opt-Out Links
- Google Analytics: Google Analytics Opt-out Browser Add-on
- Meta (Facebook): Facebook Ad Preferences
8. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. Changes will be posted on this page with an updated “Last Updated” date.
9. Contact Us
If you have questions about our use of cookies, please contact us:
Related: Privacy Policy | Terms of Service | GDPR Compliance | Manage Cookie Preferences