Cookie Policy

1. What this covers

A cookie is a small file a site stores in your browser and reads back on the next request. Browsers offer two similar stores — localStorage and sessionStorage — and this policy covers those too, because the law looks at what is placed on your device, not at what it is called.

This policy is part of our Privacy Policy, which explains what we then do with the data.

2. What we ask consent for

Under the EU ePrivacy Directive and the national laws implementing it, anything not strictly necessary to provide the service you asked for needs your consent before it is stored. So:

Strictly necessary — set without asking, because without them you cannot sign in or the app cannot work. You can block them in your browser, but the Service will not function.
Analytics — Google Analytics is loaded only after you accept it. Refuse, and no analytics cookie is written and no measurement request is sent. Refusing costs you nothing in the app.
Advertising — Google AdSense is loaded only after you accept it. Refuse, and the advert script is never requested, so no advertising cookie is written and no advert is shown.

Analytics and advertising are asked for separately, and you can accept one and refuse the other. Neither is set before you answer, and neither is pre-ticked — a switch we had already turned on for you would not be consent.

Signing in takes the adverts away

Adverts are shown only to signed-out visitors, and only on the public syllabus and federation pages, which are free to read and are what advertising pays for. From the moment you sign in — on any plan, including the free one — no advert is shown to you anywhere on this site, and no advert script is loaded on any page of your dojo. We do not pass member, attendance, grading or financial data to Google or to anyone else for advertising. Signing in is not an advertising context and we do not treat it as one.

Your choice is remembered for 12 months, then we ask again. You can change it at any time — see the last section.

3. Strictly necessary

Name	Type	Purpose	Lifetime
smartdojo-app-jwt	Cookie (first-party)	Keeps you signed in — the server reads it to know the request is yours	Up to 50 days with “Remember me”, otherwise until the browser closes
authTokensmartdojo	localStorage / sessionStorage	The same session token, read by the app in the browser	Until you sign out; sessionStorage when “Remember me” is off
smartdojo-cookie-consent	localStorage	Remembers the choice you made about analytics — without it we would have to ask on every page	12 months
__stripe_mid, __stripe_sid	Cookie (Stripe)	Set by Stripe on payment screens to detect payment fraud	1 year (mid) and 30 minutes (sid)

4. Preferences

Name	Type	Purpose	Lifetime
smartdojo-current-dojo	localStorage	Which dojo you were last working in, so /app goes back to it. Never trusted on its own — the server still checks you belong there	Until cleared
app-tour-completed	localStorage	Which guided walkthroughs you have finished, so they stop reappearing	Until cleared
smartdojo-country	Cookie (first-party)	The country your connection appears to be in, worked out from your IP address when you open the home page, so prices are shown in your own currency rather than in ours. It is not stored on our servers, it is not used to identify you, and what a dojo is actually charged is decided from the country it gives us, never from this	Until the browser closes

The two browser-storage entries above stay on your device and are never sent to us as such; the country cookie travels with each request to smartdojo.net, as every cookie does. Clearing your browser storage resets them; nothing else breaks.

5. Analytics — only with your consent

Name	Type	Purpose	Lifetime
_ga	Cookie (Google Analytics)	Distinguishes one browser from another so visits can be counted	2 years
_ga_<container-id>	Cookie (Google Analytics)	Keeps the state of the session for Google Analytics 4	2 years

We use Google Analytics 4 (Google Ireland Ltd. / Google LLC) to know which pages are used and where people get stuck. IP addresses are truncated by Google before storage, we have not enabled Google signals, advertising features or data sharing for advertising purposes, and measurement data is kept for 14 months. Data may be processed in the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses — see our Privacy Policy.

If you refuse, the Google Analytics script is never loaded. You can also install Google's own browser opt-out add-on, which works regardless of what you told us.

6. Advertising — only with your consent

The syllabus and federation pages are free to read and cost money to produce. Google AdSense (Google Ireland Ltd. / Google LLC) is what pays for them. It is loaded only on those public pages, and only if you accept advertising.

Name	Type	Purpose	Lifetime
__gads	Cookie (Google AdSense, first-party)	Distinguishes one browser from another so an advert is not shown to you the same number of times over, and so a click can be attributed	13 months
__gpi	Cookie (Google AdSense, first-party)	Carries Google's advertising identifier for this browser, used to select adverts and cap how often each is shown	13 months
__eoi	Cookie (Google AdSense, first-party)	Used by Google to detect invalid traffic and advert fraud	About 6 months
IDE, DSID, test_cookie	Cookie (doubleclick.net, third-party)	Set on Google's own domains when an advert is served, to measure and attribute it; test_cookie only checks that your browser accepts cookies at all	13 months (IDE), 2 weeks (DSID), 15 minutes (test_cookie)
NID	Cookie (google.com, third-party)	Remembers your Google advert preferences	6 months

The last two rows are set by Google on Google's domains rather than by us on ours. That distinction matters when you withdraw consent: we can delete what was set on smartdojo.net, and we do, but a cookie on doubleclick.net is not ours to reach. What refusing does guarantee is that the advert script is never loaded again, so nothing further is written or read — and Google's own controls, linked below, are what clear the rest.

We do not tell Google who you are. We pass it no email address, no member record and nothing from any dojo's books; what it receives is what any site's advert request carries — the page, your IP address and your browser. Data may be processed in the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses — see our Privacy Policy.

You can also control advertising at Google's end, whatever you told us: adssettings.google.com turns off personalised advertising across every site that uses Google, and youradchoices.eu covers the wider industry.

7. Changing your mind

Use the “Cookie settings” link in the footer of any page — the banner comes back and your choice is replaced immediately.
Or clear this site's cookies and storage in your browser: your consent record goes with them, and we will ask again on the next visit.
Blocking all cookies in your browser also works, but you will not be able to stay signed in.

Withdrawing consent is as easy as giving it, and it does not affect anything measured before you withdrew it.

8. Questions

Write to privacy@smartdojo.net and we will answer. SmartDojo, based in Japan.