Cookie Policy

1. What we mean by “cookies and similar storage”

“Cookies” are small text files placed on your device by a website you visit. We also use the browser’s localStorage for a small amount of functional state (such as remembering your accessibility preferences). Throughout this policy “cookies” covers both, unless we explicitly call out which is which.

2. The categories we use

Essential (always on, no consent required under PECR reg. 6(4))

Strictly necessary to deliver the Service you have asked for. We cannot turn these off and you cannot disable them in our cookie banner. They include:

• Authentication — keeping you signed in to the platform.
• Storing your cookie‑consent decision so we don’t ask again.
• Storing accessibility preferences (e.g. larger text, reduced motion) you have explicitly chosen.
• Security — rate limiting and protecting against abuse.

Analytics (off by default, on only with your consent)

Help us understand how visitors and users interact with the Service so we can improve it. Loaded only after you accept analytics in the cookie banner. Includes Google Analytics, PostHog product analytics and Sentry session replay / performance traces.

A separate, related point: your in‑platform performance analytics — the Pro feature that tracks your scores, drill mastery and trends over time — is first‑party application data we hold against your account. It is governed by the Privacy Policy, not this Cookie Policy. It is unaffected by your cookie choices because it is not a cookie or third‑party tracker.

If you receive emails from us about products, lessons or promotions, that’s a separate email marketing preference handled at sign‑up and in Settings → Notifications. It does not involve cookies and is not controlled by the cookie banner.

First‑party attribution

We use one small first‑party cookie, al_attr, to remember which link brought you to us. If you arrive through a tagged link — a university society, a partner, a newsletter, one of our own campaigns — it stores the code and campaign tags that were in that link, the page you landed on, and when. When you create an account, that record is attached to your account once so we can credit the right source. It holds nothing about you and nothing about your browsing: only what was in the link you clicked. It is never shared with anyone, no third party can read it, and it cannot follow you to other websites. It expires after 30 days and you can delete it at any time in your browser settings. This is not a new consent category — the cookie banner still offers Essential and Analytics only.

3. The cookies and storage we actually set

Stripe sets its own essential cookies on the checkout page it hosts, governed by the Stripe Cookie Policy. We do not control or read those cookies.

4. How we ask for and record your consent

• The cookie banner appears the first time you visit either site (or after a year, when we ask again as a refresh).
• Analytics cookies are off by default. They only load if you click Accept all. We do not treat continued use of the site as consent.
• The banner gives you two clearly-presented choices, shown side-by-side: Accept all or Reject all. Each is a single click.
• What Reject all actually stops: Google Analytics, PostHog, and Sentry session replay and performance tracing are never loaded. No third‑party analytics tag runs.
• What still runs if you reject, and why: the essential and functional items in the table above — sign‑in, your consent record itself, and your on‑device preferences — plus al_attr if you arrived through a tagged link, which we set without asking because it records the link rather than you. Sentry also still reports crashes, without session replay, so we can keep the platform working; that is explained in the Privacy Policy.
• If you accepted analytics and later reject, we stop collecting immediately and tell PostHog to opt you out. Analytics cookies already on your device are not deleted by us — you can remove them in your browser at any time.
• Your decision is mirrored across both sites via the al_cookie_consent dot‑domain cookie, so you don’t have to choose twice.
• We also send a copy of your decision to our server with the time, your account ID (if signed in), your IP address and your browser user agent, so we have an audit trail. We keep that record for 6 years.

5. Changing or withdrawing your consent

You can change your cookie choices at any time:

• On the marketing site (acumenlogic.co.uk): click Cookie preferences in the footer of any page.
• On the platform (app.acumenlogic.co.uk): click Cookie settings on the Dashboard footer, in Settings → Privacy & cookies, or at the bottom of any legal page.
• You can also clear the al_cookie_consent cookie / localStorage entry — the banner will then re‑appear on the next page load.

Your browser also lets you delete or block cookies entirely; doing so may stop you signing in or break specific features.

6. Cookies set by third parties

The following third‑party services may set cookies if you accept the relevant category:

• Google Analytics — privacy policy (analytics).
• PostHog — privacy policy (analytics).
• Sentry — privacy policy (analytics, only when session replay is on).

For Stripe (payments) and Resend (transactional email beacons in messages we send you), please see their respective privacy notices linked in our Privacy Policy.

7. Do Not Track and Global Privacy Control

Where your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to disable the Analytics category until you explicitly opt back in. We do not act on the older Do Not Track header because there is no settled UK standard for it.

8. Updates to this policy

If we add, remove or change a cookie, we will update the table above and refresh the “last updated” date. Material changes — for example, the introduction of a new category — will trigger a fresh consent banner.

9. Contact

• Email: support@acumenlogic.co.uk
• ICO complaint route: ico.org.uk