1. What cookies are
Cookies are small text files that a website stores on your device when you visit. We use cookies (and equivalent technologies like browser localStorage) for two purposes only: making the service work, and — with your consent — understanding how the service is used so we can improve it.
We do not use cookies for behavioural advertising, do not sell cookie data to third parties, and do not track users across other websites.
2. Cookies we use
The table below lists every cookie set by ExamVault or by a third party we've integrated. Essential cookies run on every visit because the service can't function without them. Analytics cookies (Google Analytics 4) only run after you click “Accept” on our cookie banner.
| Name | Set by | Type | Purpose | Duration |
|---|---|---|---|---|
| next-auth.session-token / __Secure-next-auth.session-token | ExamVault | Essential | Keeps you signed in across requests. Required for any account-based feature (dashboard, papers, packages). | 30 days (rolling) |
| next-auth.csrf-token / __Host-next-auth.csrf-token | ExamVault | Essential | Protects sign-in and form-post flows from cross-site request forgery. | Session |
| next-auth.callback-url | ExamVault | Essential | Remembers where to send you after sign-in so deep links work. | Session |
| examvault:cookie-consent (localStorage) | ExamVault | Essential | Stores your accept/decline choice for the cookie banner so it doesn't reappear on every page. | Until cleared |
| examvault:emma:* (localStorage) | ExamVault | Essential | Stores your Emma chat session id, conversation history, and any thumbs-up/down feedback you've left. Anonymous; doesn't tie to your account. | Until cleared (chat resets on click of 'New chat') |
| __stripe_mid / __stripe_sid | Stripe | Essential | Set by Stripe when you reach a checkout page; used by Stripe to detect fraud and complete payment. | __stripe_mid: 1 year; __stripe_sid: 30 minutes |
| _ga / _ga_<id> | Google Analytics 4 | Analytics | Tracks anonymised usage (pages visited, session duration, broad country-level location). IP anonymisation is enabled; no advertising features. ONLY set after you accept the cookie banner. | 2 years |
3. How to change your cookie choice
You can change your choice at any time:
- To withdraw analytics consent: clear your browser's storage for examvault.co.uk. The cookie banner will reappear; click “Decline”.
- To enable analytics: same — clear storage, reload, and click “Accept”.
- To block all cookies: use your browser's cookie settings to block third-party cookies and/or cookies from examvault.co.uk specifically. Note that this will sign you out and disable account features.
Most browsers have detailed cookie controls in their settings:
4. Google Analytics specifics
We use Google Analytics 4 (GA4) only with the following privacy-protective settings, and only after you consent:
- IP anonymisation on by default.
- No advertising features — we don't enable remarketing, demographic data, or any other ad-related GA4 feature.
- No user-ID linkage — we don't connect GA4 data to your account.
- Data retention set to the GA4 minimum (currently 2 months) for user-level data.
You can opt out of GA4 across all websites by installing the Google Analytics Opt-Out Browser Add-on.
5. Updates to this policy
We'll update this page if we add or remove any cookies, change durations significantly, or switch analytics providers. The date at the top of the page reflects the most recent change.