TrulySpeak privacy
TrulySpeak Cookie Policy
Last updated 13 August 2026. This inventory describes verified first-party cookies and browser storage in the current application.
1. What cookies are
Cookies are small data files stored or accessed by a browser. TrulySpeak also uses local storage for equivalent functions such as preferences, consent evidence and optional analytics identifiers.
2. Categories
Strictly necessary
Authentication, session security, CSRF protection, requested language and recording cookie choices.
Optional analytics and performance
First-party anonymous tutor-application measurement and campaign attribution. These remain off until affirmative consent.
Marketing
No marketing or advertising cookie category is implemented in the current application.
3. Actual inventory
| Cookie or storage key | Provider and purpose | Category | Duration | Party |
|---|---|---|---|---|
sessionid | TrulySpeak / Django Authenticated session continuity | Strictly necessary | Up to 14 days | First party |
csrftoken | TrulySpeak / Django Cross-site request-forgery protection | Strictly necessary | Up to one year | First party |
trulyspeak-locale | TrulySpeak Remember the interface language requested by the user | Strictly necessary preference | One year | First party |
trulyspeak-cookie-consent | TrulySpeak Store the current necessary and optional-analytics choice | Strictly necessary | Local storage until cleared or the consent version changes | First party |
trulyspeak:analytics-anonymous-id:v1 | TrulySpeak Anonymous tutor-application product measurement | Optional analytics | Local storage until cleared | First party |
trulyspeak:campaign-attribution:v1 | TrulySpeak Consent-gated UTM and gclid campaign attribution | Optional analytics | Local storage until cleared | First party |
4. Consent
Necessary technologies operate to provide the service. Optional analytics creates no identifier, campaign record or analytics request before an affirmative choice. Rejecting is presented alongside accepting, and a choice can be changed later with the “Change cookie choices” control.
5. Browser controls
Browser or device settings can remove storage. Disabling necessary cookies may prevent authentication, security checks or requested preferences from working.
6. Third parties
The current analytics endpoint is first party. Cloudflare Turnstile loads on registration outside the local bypass environment. Google and Microsoft authentication redirect to their own services when selected. Stripe uses an external checkout only when a top-up is started. Approved YouTube media uses the privacy-enhanced youtube-nocookie.com embed and is lazy-loaded on user interaction. Their own sites may apply separate storage when invoked; no unverified cookie names are listed here.
7. Contact
Not configured — required before deployment