Cookie statement
The short version
- Before login, Studim.ai sets no cookies.
- After login your browser stores only the session cookie that keeps you signed in. It is strictly necessary and needs no consent.
- Three settings (theme, interface language and the language chosen on the legal pages) live in your browser's local storage. They need no consent either.
- We count page views with Vercel Web Analytics, without cookies and without an identifier in your browser. There are no analytics cookies, no advertising cookies, no tag manager and no fonts from third-party servers. That is why we show no cookie banner.
What cookies and local storage are
Cookies are small text files a website places in the browser, which the browser sends back with every request to that website. Local storage is a similar store in the browser whose content is not sent to the server automatically. Both fall under § 25 TDDDG (German Telecommunications Digital Services Data Protection Act): accessing the device needs consent unless it is strictly necessary to provide a service you explicitly requested (§ 25 (2) no. 2 TDDDG).
Before login
The landing page, the pricing page, the FAQ page, the contact page and these legal pages set no cookies and write nothing to local storage, with one exception: if you switch the language or the theme on one of these pages, the browser remembers that choice in local storage (see below). Fonts, scripts and images are served from our own address; no connection is made to Google Fonts or other third parties. This includes the audience measurement script, which our hosting provider Vercel serves under our own address (section "Audience measurement without cookies").
After login: cookies
| Name | Provider | Purpose | Type | Lifetime |
|---|---|---|---|---|
| sb-wrhwjpwnajviiqahyvsi-auth-token (split into sb-wrhwjpwnajviiqahyvsi-auth-token.0, .1, ... when the value is long) | Studim.ai (set by Supabase's sign-in library, first-party cookie under studim.ai) | Keeps you signed in and refreshes the session. Contains your access token and the refresh token. First-party cookie, SameSite=Lax; readable by the browser (not httpOnly) because the app itself reads it. | Strictly necessary (§ 25 (2) no. 2 TDDDG) | Until you sign out or it expires; technical maximum 400 days (default of the sign-in library) [CONFIRM IN DEVTOOLS] |
| sb-wrhwjpwnajviiqahyvsi-auth-token-code-verifier | Studim.ai (same library) | Secures the sign-in with Google (PKCE). Needed only during the redirect to Google and back. | Strictly necessary | A few minutes; removed after sign-in [CHECK IN BROWSER DEVTOOLS] |
When signing in with Google you briefly leave our site; which cookies Google sets on its own pages is decided by Google (see Google's privacy policy). Google sets no cookies on studim.ai.
Local storage
| Key | Purpose | Type | Lifetime |
|---|---|---|---|
| studim-theme | Remembers whether you chose the light paper or the dark blackboard theme. | Functional, strictly necessary for the chosen display | Until you clear the site data in your browser |
| studim-lang | Remembers the chosen interface language. | Functional, strictly necessary for the chosen language | Until you clear the site data in your browser |
| studim-legal-lang | Remembers whether you want to read the legal pages (legal notice, privacy, terms, withdrawal, cookies, contact) in German or English. | Functional, strictly necessary for the chosen language of the legal pages | Until you clear the site data in your browser |
None of the three values leaves your browser, and none allows recognizing you across other websites.
What there is not
- No analytics services with cookies or identifiers in the browser (no Google Analytics, no Matomo, no heatmaps). Vercel's cookieless audience measurement is described in the section below.
- No advertising networks, no retargeting, no social media plugins.
- No tag manager. The only script that is not part of the app itself is the audience measurement script; it comes from our hosting provider Vercel and is served from our own address.
- No fonts from Google Fonts or other external servers; all fonts load from our own address.
- No fingerprinting and no cross-device tracking.
As long as this holds, no cookie banner and no consent is required. The legal basis for processing the data linked to the session cookie is Art. 6 (1) (b) GDPR (contract); for the three settings Art. 6 (1) (f) GDPR (legitimate interest in a working display); for the audience measurement Art. 6 (1) (f) GDPR (legitimate interest in knowing which pages are visited and where visitors come from).
Deleting or blocking cookies
You can delete or block cookies and local storage at any time in your browser settings. If you delete the session cookie you are signed out. If you block local storage the service keeps working; only the theme, the language and the language of the legal pages are not remembered. You can sign out in the dashboard sidebar (Sign out); that removes the session cookie.
Audience measurement without cookies (Vercel Web Analytics)
Since 11 October 2026 we count page views with Vercel Web Analytics, a service of our hosting provider Vercel (Vercel Inc., USA), which acts as our processor; the existing data processing agreement with Vercel covers the measurement. The script is served from our own address, sets no cookie, writes nothing to local storage and places no identifier in your browser. It therefore accesses no information on your device, so § 25 TDDDG requires no consent. The legal basis for the processing is Art. 6 (1) (f) GDPR (legitimate interest in knowing which pages are visited and where visitors come from, to improve the website).
On every page view, before and after login, the script sends to Vercel, and to Vercel only: the path of the page, the referring page (referrer), browser, operating system and device type, and any campaign parameters (utm) in the address. Vercel derives the country from the IP address and states that it does not store the IP address. To tell returning visitors from new ones, Vercel builds on its server a hash from the IP address and the browser signature, which is discarded after 24 hours. Lecture content, your account id and search terms are not sent. The statistics at Vercel are aggregated; retention per Vercel's plan: [CONFIRM ANALYTICS RETENTION IN VERCEL DASHBOARD]. [LAWYER: Check whether the server-side hash of IP address and browser signature at Vercel, discarded after 24 hours, counts as access to the device under § 25 TDDDG or as fingerprinting. As we understand it, the script reads no identifier from the browser and places none.]
If you do not want to be counted, block the script with a content blocker or in your browser settings (address /_vercel/insights/); the website keeps working unchanged. We do not build our own switch, because it would have to store a setting in your browser.
Whenever Vercel changes the script and whenever a new measurement is added, we check:
- that the script still sets no cookie and writes nothing to local storage (browser developer tools on the landing page, the pricing page and in the dashboard);
- that page views and referrers go to Vercel only, through the address /_vercel/insights/ under our own domain, and to no other address (network tab);
- that no lecture content, no account id and no search terms are in the data sent;
- whether the data processing agreement with Vercel still covers the measurement and where Vercel processes the data;
- the update of this statement, of the privacy policy (section 4.13) and of the internal record of processing.
Questions
We answer questions about this statement at hello@studim.ai. More about data processing is in the privacy policy.
Last updated: 11 October 2026