Cookie Policy
Last updated: 26 October 2026
This page explains the cookies and similar technologies Monarch uses, what each one is for, and how long it lasts. We use only a small number, we set no advertising or cross-site tracking cookies, and nothing non-essential runs until you choose to allow it. It is written in plain language so both students and parents can follow it. For the wider picture of how we handle your data, see our Privacy Policy.
Essential
Required for Monarch to work - signing in, security, and remembering your cookie choices. These never track you across other sites.
When: Always active. · Legal basis: Strictly necessary (EU ePrivacy Directive Art 5(3)) - no consent required.
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| token | Cookie (httpOnly) | Keeps you signed in. A signed session token that proves who you are on each request. | 7 days |
| totp_pending | Cookie (httpOnly) | Holds a half-finished two-factor sign-in between entering your password and your code. | Until sign-in completes (short-lived) |
| monarch_pwreset | Cookie (httpOnly) | Authorises a password reset once you have verified the emailed code. | Short-lived (password-reset window) |
| monarch_webauthn_session | Cookie (httpOnly) | A one-time challenge that lets you sign in with a passkey securely. | A few minutes |
| monarch_webauthn_enroll_session | Cookie (httpOnly) | A one-time challenge used while you register a new passkey. | A few minutes |
| monarch_oauth_state | Cookie (httpOnly) | A one-time anti-forgery (CSRF) token that protects the 'Continue with Google' sign-in flow. | 5 minutes |
| monarch_oauth_human | Cookie (httpOnly) | Shows you passed the are-you-human check just before 'Continue with Google', so the sign-in can start. Used once, then cleared. | 2 minutes |
| pdf_verified | Cookie (httpOnly) | Confirms you passed the are-you-human check before we serve past-paper PDFs. | 4 hours |
| pdf_claims | Cookie (httpOnly) | Remembers which papers you opened today so re-opening them does not use your daily quota again. | 36 hours |
| monarch-cookie-consent | Local storage | Stores your cookie and analytics choices so we honour them and do not ask again on every visit. | 12 months |
| monarch-theme | Local storage | Remembers your light or dark theme preference. | Until cleared |
Third-party services
- Cloudflare Turnstile — Confirms a real person, not a bot, when you create an account, when you sign up or sign in with 'Continue with Google', and before we serve past-paper PDFs, to stop automated sign-ups and scraping. No behavioural profiling or cross-site tracking. (Cloudflare challenge storage, set only while the check runs; gated by Strictly necessary (security / bot defence) - no consent required.) Their privacy policy
Analytics
Pseudonymous usage and performance data that helps us improve Monarch. Pseudonymous means a random device ID, never your name or email.
When: Off until you choose Accept in the cookie banner. · Legal basis: Consent (GDPR Art 6(1)(a)); accepting requires affirming you are 16 or older (Art 8).
Third-party services
- PostHog — Pseudonymous product analytics - which pages and features are used - to improve Monarch. (Cookies (ph_*) and local storage; gated by Analytics consent.) Their privacy policy
- Vercel Web Analytics — Aggregate page-view counts. No cookies, no cross-site tracking, no personal profiles. (Cookieless - sets no cookies; gated by Analytics consent.) Their privacy policy
- Vercel Speed Insights — Real-user performance metrics (Core Web Vitals) so pages stay fast. (Cookieless - sets no cookies; gated by Analytics consent.) Their privacy policy
- Sentry (error monitoring) — Captures client-side errors so we can fix bugs. Server-side error logging runs as legitimate interest and sets nothing on your device. (No cookies (in-memory only); gated by Analytics consent.) Their privacy policy
Session replay
A more detailed recording of on-page interaction (text and inputs masked) used only to reproduce bugs. Narrower and separate from analytics.
When: Off until you tick the separate session-replay opt-in. · Legal basis: Separate, explicit consent (GDPR Art 6(1)(a)).
Third-party services
- Sentry Session Replay — Records how you navigate and interact with pages, with all text and form inputs masked, to reproduce bugs. 10% sample. Off unless you separately opt in. (Session storage; gated by Session-replay consent (separate).) Their privacy policy
Personalisation
Remembers what you study — such as the subjects you star — so Monarch can surface them first. First-party only; never used to track you across other sites. Independent of analytics: you can turn it on without accepting analytics.
When: Off until you turn Personalisation on in the cookie banner or Settings. · Legal basis: Consent (GDPR Art 6(1)(a)); requires affirming you are 16 or older (Art 8).
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| monarch-personalisation-data | Local storage | Remembers what you study — e.g. the subjects you star — so we can surface them first. Only stored if you turn Personalisation on; cleared the moment you turn it off. | Until cleared or consent withdrawn |
Managing and clearing cookies
You can clear cookies at any time through your browser settings, and you can block them entirely — though blocking essential cookies will stop you signing in. To change only your analytics or session-replay choices, use “Manage cookies” below or Settings → Privacy & data. For any data request, email contact@studymonarch.com.