On this page
Cookies and browser storage
Cookies are values a browser sends with matching requests. Local storage keeps preferences on a device; session storage supports a browser-tab session. Browser behaviour can affect how long these remain. This notice covers the current application; authentication, proxy and embedded services may use additional storage on their own domains.
The inventory below describes implementation defaults, not a promise that every value is set on every visit. The final hosted deployment needs a browser inventory including its identity and network providers before this notice is approved.
Sign-in and request protection
__Host-session identifies your LMS session and is Secure and HttpOnly. __Host-csrf supports protection against forged write requests and must be readable by the application. Both use the issued session’s remaining absolute lifetime and are cleared by LMS sign-out; the identity-provider session may be separate.
The Keycloak sign-in service and any company identity provider can set their own authentication cookies. Lifetimes depend on the configured realm and provider. Confirm the actual names and durations on the auth domain for the final deployment rather than assuming the LMS cookie list is exhaustive.
Privacy preferences
__Host-activity is a Secure, HttpOnly visitor identifier used to associate privacy choices when an anonymous visitor saves preferences on a configured public site. Its current browser maximum age is 180 days. It is not automatically set merely by opening the public page. Signed-in choices are associated with the account on the server.
Analytics and marketing choices are separate and default to off. Where available, use the Privacy choices button to review, decline or withdraw optional sharing. Clearing browser cookies may remove an anonymous preference; server-side account preferences and previously delivered events are separate. A page without an available privacy control may not have public activity configured.
Workspace and demo preferences
Local storage remembers the colour theme, sidebar collapse state, and section order/visibility. These values normally remain until changed or cleared in the browser. Section preferences are scoped to the workspace view so the interface can remember your arrangement.
Session storage holds fictional demo state and the demo-mode marker. A message return hint can also help resume navigation after sign-in; the app ignores a hint older than 30 minutes and removes it when handled. Do not enter confidential real information into the public demo.
Optional analytics and embedded media
The current integration adapters send approved events from the server; they do not automatically install Google Tag Manager, a Google browser tag or a Meta browser pixel. A future browser integration requires its own reviewed inventory and controls. Server-side tracking can still involve personal data even when it sets no vendor cookie.
Choosing to load a YouTube or Vimeo embed connects your browser to that provider. Provider storage and data use depend on the selected embed and your provider account/settings. Review the provider’s own notice. Permission to load media is distinct from permission to forward analytics or marketing events.
Managing storage
Your browser settings can clear or block cookies and website storage. Blocking sign-in or request-protection storage can prevent the workspace from working. Clearing local preferences resets presentation choices and can remove demo edits.
To stop optional sharing, use the platform’s privacy controls as well as any relevant provider controls. Clearing local storage alone does not withdraw a server-side account preference or erase a learning record. Contact your organisation for account-data requests.
Need a little clarity?
Start with your company administrator for workspace records. For platform questions, use our existing general contact.
[email protected]