Cookie notice

The language you chose

Name: lang. It holds one word, en or es, and nothing else. It lasts a year, it is sent to this domain and to no other, and it is written only when you change the language from the header. Until you do, the site works out which language to answer in from what your browser asks for, and stores nothing.

The answer about external content

Name: txmska_consent. It holds a version and one digit: whether you allowed external content. It lasts a year, it is sent to this domain and to no other, and it is written only when you answer the banner. Until you answer, nothing is asked of YouTube and no player is in the page. Cookie settings in the footer reopens that answer, and a change refreshes the page you are reading.

The editor's session

Name: txmska_session. This is the signed session for a staff account. It carries the account id, its issue and expiry times, a random session id and a signature made with a key only the server has. The database keeps only a hash of that random id, so a copied database cannot become a cookie; it also lets the account revoke one browser at a time. It is not a record of anything you read. No script can read it, another site cannot make your browser send it with a form or a background request, in production it only travels over HTTPS, and it expires after eight hours. If you have never signed in to the panel, you have never had it.

The password check

Name: txmska_login. This short-lived signed cookie appears after a staff member's password is checked and before the second factor. It carries the account id, expires after ten minutes and is removed when the login is completed. It cannot open a panel session by itself.

The trusted-device cookie

Name: txmska_trusted. The panel writes this only when a staff member chooses to trust the device after entering a TOTP or backup code. It contains a random value, while the database keeps its hash and a thirty-day expiry. While it is valid, that browser can skip the TOTP step for that account. It is not used to identify readers or track visits.

Account setup

Name: txmska_setup. This temporary cookie is used only while an invited staff member sets up a TOTP app. It holds the encrypted secret between showing the QR code and confirming the code, is scoped to the setup page and expires after thirty minutes. It is removed when setup is confirmed and is not set on public pages.

The editor display scale

Name: txmska_admin_scale. This remembers small or big after a staff member chooses it from the editor menu. It is sent only to /admin, lasts a year and has no account identifier or browsing history. It is not httpOnly because the menu writes it immediately in the browser; it is not used to authorise anything.

What Learning keeps in your browser

Name: txmska.learning.v1. This one is not a cookie: it is an entry in this browser's local storage, and it never travels to the server or to anybody else. It holds the courses you saved, the classes you marked as watched and the last class you opened, all of them as the short names that appear in the address. It is written only when you mark something, there is no account behind it and nothing in it says who you are. Clearing this site's data in your browser removes it, and Learning goes back to a clean list.

Unfinished new entry

Name: txmska-overview-new-entry. This is not a cookie. The overview new-entry flow writes one session-storage entry in the current tab. It holds the step, template, title, section, subcategory and summary of an unfinished draft. Only that flow reads it. It lasts for the tab and is removed when the draft is discarded or the tab closes.

First-party counts

The first-party counters described in the privacy notice use no cookie, local storage or session storage. Count requests go only to this site, and these counters do not read the existing language, external-content, panel or Learning-progress preferences. They add no third-party script and do not change the choice about loading YouTube videos.

What is not here

First-party count requests are described in the privacy notice; they do not build a browser fingerprint or an individual browsing profile. Only YouTube videos in Learning classes and blog posts load from another domain after external content has been allowed.

Which ones are necessary

The authentication and setup cookies are strictly necessary to complete sign-in, keep a staff account signed in and finish account setup. The language and display-scale cookies are preferences, written only when a person chooses them, and the Learning entry is the same kind of thing, written only when you mark a course or a class. The answer about external content is a necessary cookie too: it is how the site remembers not to ask again. None of them measures anything or follows anyone from one page to the next or from one site to another, which is why the banner asks about one thing and asks it once.

What your browser still does

Your browser keeps pages, images and fonts in its cache so the site opens faster next time. That is the browser doing its job rather than the site keeping something, and emptying the cache removes it.

If this changes

If something is added that needs more than these, this page says so before it ships, and anything that is not strictly necessary asks first. What the contact form keeps is in the privacy notice. Anything else, write to business@txmska.com.