1. What are cookies?
Cookies are small text files stored on the User’s end device (computer, tablet, smartphone) by the web browser while using the service.
Cookies are used to store information about how the service is used, identify the user’s session, remember preferences and ensure the correct operation of individual features. Cookies do not damage the device, do not contain malicious software or personal data such as first name, last name or e-mail address (they may, however, contain session identifiers enabling the activity to be linked to an Account).
This Cookie Policy supplements the Privacy Policy and the Terms of Service of lern.one. Capitalised terms have the meaning given to them in the Terms.
2. Legal bases for using cookies
The use of cookies in the Service is based on:
- Art. 173 of the Polish Telecommunications Law Act of 16 July 2004 - regulating the rules for storing and accessing information on the User’s end device.
- Art. 6 sec. 1 lit. a GDPR - the User’s consent (analytics, performance, functional cookies).
- Art. 6 sec. 1 lit. f GDPR - the Controller’s legitimate interest (cookies necessary for the operation and security of the Service).
- Directive 2002/58/EC (ePrivacy Directive) - to the extent implemented into the Polish legal order.
Cookies necessary for the operation of the Service (strictly necessary) do not require consent - their use is necessary to provide the service expressly requested by the User. The remaining categories require prior, voluntary consent.
3. For what purposes do we use cookies?
- Providing the basic functionality of the service - maintaining the logged-in User’s session, authentication, protection against CSRF attacks, handling forms, remembering the cookie consent.
- Remembering preferences and personalisation - the chosen interface theme (light/dark), language, recently used filters, accessibility settings.
- Analytics and statistics - anonymous and aggregated data about how the Service is used (number of visits, most visited pages, traffic sources) in order to improve the Service.
- Performance, monitoring and security - measuring load speed (TTFB, LCP), detecting errors, protection against abuse and attacks.
The Service does not use cookies for advertising purposes (targeting, retargeting, behavioural advertising). We do not profile Users for marketing purposes.
4. Types of cookies used
4.1. Strictly necessary cookies
Uses:
- Session token of the logged-in User (Supabase authentication)
- CSRF protection token (form protection)
- Storage of cookie consent preferences
- Session identifier required for the Service to work
- Session data of the payment process (Stripe Checkout)
Storage time: Session or persistent - up to 12 months
Legal basis: Art. 6 sec. 1 lit. f GDPR + Art. 173 sec. 3 point 2 of the Telecommunications Law
Cannot be disabled - without them the Service does not work correctly.
4.2. Functional cookies (preferences)
Uses:
- Interface theme - light/dark (theme)
- Interface language (lang)
- Saved filters and search criteria
- Recently viewed materials
- Font size and accessibility settings
Storage time: Up to 12 months
Legal basis: Art. 6 sec. 1 lit. a GDPR (User’s consent)
Can be disabled - some personalisation features may not work.
4.3. Analytics cookies
Uses:
- Number of visits, unique sessions and page views
- Time spent on individual pages
- Traffic sources (referer) and navigation paths
- Error and exception indicators
- Geographic data at country level (anonymised IP)
Storage time: Up to 24 months
Legal basis: Art. 6 sec. 1 lit. a GDPR (User’s consent)
Provider: Google Analytics (optional), internal analytics tools
Can be disabled - no impact on the operation of the Service.
4.4. Performance cookies
Uses:
- Page load time (Time to First Byte - TTFB)
- Largest Contentful Paint and Core Web Vitals metrics
- Rendering stability (Cumulative Layout Shift)
- Diagnosing client-side performance issues
Storage time: Up to 12 months
Legal basis: Art. 6 sec. 1 lit. a GDPR (User’s consent)
Provider: Vercel Speed Insights (if active)
Can be disabled - no impact on the operation of the Service.
5. Detailed list of cookies
The table contains the list of cookies used in the Service as of the date of the last update. The list may change as the Service develops.
| Name | Category | Purpose | Provider | Type | Validity |
|---|---|---|---|---|---|
| sb-*-auth-token | Necessary | Supabase authentication token | Supabase / own | Persistent | Up to 12 mo. |
| sb-*-auth-token-code-verifier | Necessary | PKCE verification in the login process | Supabase / own | Session | Until the browser is closed |
| csrf_token | Necessary | Protection against CSRF attacks | Own | Session | Until the browser is closed |
| cookie_consent | Necessary | Remembering cookie consent preferences | Own | Persistent | 12 mo. |
| __stripe_mid | Necessary | Stripe customer identifier | Stripe | Persistent | 12 mo. |
| __stripe_sid | Necessary | Stripe Checkout session identifier | Stripe | Session | Up to 30 min. |
| theme | Functional | Remembering the theme (light/dark) | Own | Persistent | 12 mo. |
| lang | Functional | Remembering the chosen language | Own | Persistent | 12 mo. |
| saved_filters | Functional | Remembering the last filters | Own | Persistent | 6 mo. |
| _ga | Analytics | Google Analytics identifier | Google LLC | Persistent | 24 mo. |
| _ga_* | Analytics | Google Analytics 4 session state | Google LLC | Persistent | 24 mo. |
| perf_lcp | Performance | Largest Contentful Paint measurement | Vercel / own | Persistent | 12 mo. |
| perf_cls | Performance | Cumulative Layout Shift measurement | Vercel / own | Persistent | 12 mo. |
Names marked with an asterisk (*) contain variable identifiers (e.g. the Supabase project identifier). The actual names may differ slightly from the above patterns.
6. Other data storage technologies
In addition to cookies, the Service may use the following data storage technologies in the User’s browser:
- Local Storage - persistent client-side data storage (theme preferences, interactive whiteboard state, material cache). The data does not expire - it is deleted by the User or the Service’s code.
- Session Storage - analogous to Local Storage, but the data is stored only for the duration of the browser session (until the tab is closed).
- IndexedDB - a browser database for storing larger sets of data on the client side (material cache for offline work, interactive Whiteboard data).
The rules for giving and withdrawing consent are analogous to cookies. The User can delete the data stored by these technologies in the browser’s developer tools (Application → Storage).
7. Third-party cookies
The Service may use cookies from third parties (providers) over which the Controller has limited control.
| Provider | Purpose | Category | Privacy policy |
|---|---|---|---|
| Vercel, Inc. | Hosting, CDN, performance metrics (Speed Insights) | Necessary / Performance | vercel.com/legal/privacy-policy |
| Supabase, Inc. | Authentication, session management, database | Necessary | supabase.com/privacy |
| Stripe, Inc. | Payment processing, fraud prevention | Necessary | stripe.com/privacy |
| Google LLC | Google Analytics (optional - only after consent) | Analytics | policies.google.com/privacy |
The Controller is not liable for the privacy policies and cookie practices used by third parties. For Google Analytics, we apply IP address anonymisation (anonymize_ip) and a shortened retention period. GA is activated only after the User gives consent.
8. Giving and withdrawing consent to cookies
8.1. Consent banner. On the first visit, the User is informed about the use of cookies via a banner. The banner allows: accepting all categories, rejecting non-necessary cookies, granular consent to individual categories.
8.2. Voluntary consent. Consent to analytics, functional and performance cookies is voluntary. Its absence does not prevent the use of the Service - only necessary cookies remain active.
8.3. Withdrawing consent. The User may change or withdraw consent at any time by re-displaying the banner (link in the footer / Account settings), changing browser settings (§9), deleting cookies. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
8.4. Recording consent. The fact of giving, refusing or withdrawing consent is recorded in the cookie_consent cookie stored for a period of 12 months. After this period expires, the consent banner will be displayed again.
9. Managing cookies in the browser
Regardless of the consent banner, the User can manage cookies in the browser settings:
- Google Chrome - Settings → Privacy and security → Cookies and other site data.
- Mozilla Firefox - Settings → Privacy & Security → Cookies and site data.
- Apple Safari - Preferences → Privacy → Cookies and website data. iOS: Settings → Safari → Block cookies.
- Microsoft Edge - Settings → Privacy, search and services → Cookies and site permissions.
Most browsers offer a private mode (incognito / InPrivate), in which cookies are deleted after the window is closed. The Controller is not liable for the operation of cookie-management extensions (uBlock Origin, Privacy Badger, etc.).
10. Do Not Track signal (DNT)
The Service honours the Do Not Track signal sent by the User’s browser. If the browser sends the header DNT: 1, the Service limits the use of cookies to the scope necessary for proper functioning (only necessary cookies). Analytics, performance and functional cookies will not be installed, and existing tracking scripts will be deactivated.
11. Impact of disabling or deleting cookies
| Disabled category | Consequences |
|---|---|
| Necessary | Inability to log in, loss of session, no CSRF protection, inability to use paid Services, complete prevention of the proper operation of the Service. |
| Functional | No remembering of theme, language, filters; the need to set preferences again on each visit. |
| Analytics | No impact on the operation of the Service from the User’s perspective. The Controller does not analyse how the Service is used in order to improve it. |
| Performance | No impact on the operation of the Service from the User’s perspective. The Controller does not monitor or optimise load speed. |
Completely blocking cookies in the browser will cause the Service to malfunction. The Controller is not liable for limitations in the operation of the Service resulting from the User blocking cookies.
12. Changes to this Cookie Policy
The Controller reserves the right to update this Cookie Policy, in particular in the event of: changes in the law, new features requiring additional cookies, change of external providers, recommendations or decisions of supervisory authorities.
The Controller will inform of material changes via a notice in the Service. When expanding the scope of cookies requiring consent, the consent banner will be displayed again. The date at the beginning of the document indicates the date of the last update.