Cookie policy

• authjs.session-token, authjs.csrf-token, authjs.callback-url: keep you signed in and protect sign-in forms. Set by our site, expire when you sign out or after the session lifetime.
• pdid: a random device identifier (signed, up to 2 years) that keeps free rounds shared per device and helps prevent fraud; a copy is kept in your browser's local storage. See the privacy policy.
• Cloudflare (for example cf_clearance, __cf_bm): may be set when Cloudflare protects a page or a form against bots.
• Stripe: Stripe Checkout sets its own cookies on its pages to prevent fraud when you pay.

These cannot be switched off without breaking sign-in or payments, so they do not need consent.

Google Analytics 4 (_ga, _ga_*, up to 2 years) tells us which pages are visited and which buttons lead to sign-ups, in aggregate. Before you choose, and if you decline, Google Analytics is not loaded at all: no script from Google, no request to Google, no analytics cookies. Ads features are always off. If you accept and later decline, the _ga cookies are removed and the tag is not loaded again.

We also use Vercel Web Analytics, which counts page views without cookies or cross-site identifiers.

With the same analytics consent, first-party practice measurement records the round id and time when you open your own graded practice report. The round links this receipt to your account. It helps us measure return practice and sets no additional cookie. It excludes report content, marketing query parameters, shared links, company assessments and staff reads. Declining stops new receipts.

Your consent choice itself is remembered in your browser's local storage (praxis-analytics-consent-v2), not in a cookie. Your browser checks it before sending a practice report-open receipt, and the server accepts the receipt only with that opt-in.

You can change your mind at any time. Declining later also stops new analytics cookies from being set.