Cookie Notice

1. What This Notice Covers

This Notice explains the cookies, local storage, and similar technologies we use on the Tenebrite website and application. It supplements the Privacy Policy.

2. What Cookies Are

Cookies are small text files placed on your device by a website. We also use related browser-storage mechanisms (localStorage, sessionStorage) to remember preferences without server round-trips. Together we refer to these as “cookies and similar technologies.”

3. Cookies and Storage We Use

3.1 Strictly Necessary

Required to provide the Service. Cannot be disabled without breaking sign-in or core functionality. On the live site each name below carries a __Secure- or __Host- prefix, which tells your browser to send it only over an encrypted connection.

• next-auth.session-token — httpOnly, secure, SameSite=Lax. Keeps you signed in. Expires after 30 days or on sign-out.
• next-auth.csrf-token — CSRF protection for auth flows. Session-scoped.
• next-auth.callback-url — temporary state for OAuth redirects. Session-scoped.
• next-auth.state and next-auth.pkce.code_verifier — set only while you sign in with Google, to confirm the response came back to the same browser that started the sign-in. httpOnly; expire after 15 minutes.

3.2 Functional Cookie

• tenebrite-privacy-opt-out — set only when you turn on the manual opt-out in Settings → Privacy, and removed when you turn it off. Lasts one year. Sent to our server, which checks it alongside the Sec-GPC: 1 request header to determine your effective privacy state; readable by the page so the setting displays correctly.

3.3 Functional (LocalStorage, not cookies)

Stored entirely in your browser; not transmitted to our servers. Clearing your browser storage removes them.

• tenebrite-prefs — your theme (light / dark / auto), the Block Notifications switch, and the focus-playlist link you save in Settings → Notifications.
• tenebrite-focus-bar-pos and tenebrite-capture-pos — remember where you placed the minimized focus-timer pill and the quick-capture button.
• tenebrite-tutor-width and tenebrite-competencies-open — remember how wide you made the tutor panel and whether you collapsed the mastery panel on a pillar page.
• tenebrite-icon-overrides — per-pillar icon customizations.
• tenebrite-onboarded-v2, tenebrite-update-seen and tenebrite-hints-v1 — first-run flags that record whether you have seen the welcome introduction, the current “what’s new” notice, and each page’s one-time explanation, so none of them shows twice. Each is stored per account: the key ends with your account ID, so people sharing a browser each keep their own.

3.4 Analytics

We do not currently use third-party analytics, advertising, or tracking cookies. If this changes, we will update this Notice and (where consent is required) request your consent before setting them. The hosted Service may use Sentry for error reporting; Sentry sets no cookies, receives technical error data only, and its browser-side component is disabled for users with an active privacy opt-out (see the Privacy Policy).

4. Third-Party Content

The Service embeds no third-party content in frames or players, and sets no third-party cookies. Focus-session backgrounds and any ambient audio are served from our own domain. Files you upload yourself (a profile picture, note attachments) are served from our storage provider, Supabase, which holds them on our behalf (see the Privacy Policy, Section 7).

Two kinds of image are exceptions: your browser fetches them directly from another company’s server.

Your Google or GitHub profile picture. If you signed in with Google or GitHub and have not uploaded a picture of your own, the app’s header shows the picture from that account, loaded directly from Google’s (lh3.googleusercontent.com) or GitHub’s (avatars.githubusercontent.com) image server. That request discloses your IP address and browser user-agent to that company, along with our site’s address, but not the page you were viewing. We set no cookies through it; any cookies Google or GitHub may set are governed by their own policies. Uploading a picture under Settings → Profile replaces it.

Video thumbnails. Where the tutor’s video recommendations are available, the preview cards load their thumbnail images directly from YouTube’s image server (i.ytimg.com), so your browser makes a request to Google to fetch each picture. That request necessarily discloses your IP address and browser user-agent to Google. We send no referrer with it, so the page you were viewing is not disclosed, and we set no cookies through it; any cookies Google may set are governed by Google’s own policies. Nothing plays inside the Service — the cards are links.

Choosing a recommendation navigates you to youtube.com, which is Google’s site and subject to Google’s cookie and privacy practices, not this Notice.

5. Managing Cookies

You can control cookies through your browser’s settings or by using browser-level “Do Not Track” / Global Privacy Control signals. Note that disabling strictly necessary cookies will prevent sign-in. To clear browser-side preferences, clear site data for the Tenebrite domain.

Helpful guides: Chrome, Firefox, Safari, Edge.

6. Global Privacy Control

Tenebrite honors browser-issued Global Privacy Control (GPC) signals as a valid opt-out request under California law and the GPC W3C draft specification. The Sec-GPC: 1 header is detected on every request; users can also record an explicit opt-out under Settings → Privacy, which is persisted in a first-party cookie (tenebrite-privacy-opt-out) for one year. The Privacy tab also shows which signal is currently active.

Either signal puts you in opt-out state. We do not sell or share personal information for cross-context behavioral advertising and ship no third-party analytics; the opt-out also disables browser-side error reporting where that is enabled. Any future analytics integration must gate on this signal.

7. Changes to This Notice

We will update this Notice if our use of cookies changes. The “Effective” date at the top of this page will reflect the most recent revision.

8. Contact

Questions about this Notice may be sent to privacy@tenebrite.com.