Cookie notice

DRAFT — not reviewed by a lawyer and not in force. It lists what the software sets today. Whether a consent banner is needed in a given country, and what the wording must be, is for qualified counsel to decide.

What we set

Two cookies, both strictly necessary to keep a person signed in. Neither is used to track you across sites, for advertising or for analytics.

• hlk_session: keeps a parent, guardian or child signed in. Parent sessions last up to 12 hours and child sessions up to 3 hours. Only a one-way hash of its value is stored on our server.
• hlk_admin: set only for the company’s own administrators when they sign in to the admin pages. Visitors and families never receive it. Admin sessions last one hour.

Both are HttpOnly (page scripts cannot read them), SameSite=Strict (not sent with requests that start on other sites), and Secure on the live site (sent only over HTTPS).

What we do not set

No advertising, analytics, social-media or other third-party cookies or trackers. The site does not store anything else in your browser’s local or session storage to identify you [to be re-checked before launch, and again whenever a feature is added].

Your choices

You can delete these cookies in your browser at any time; you will simply be signed out. Blocking them means you cannot sign in.

See also the privacy notice (draft) and the terms of use (draft). Version label: draft-2026-10.