1. What Are Cookies?
Cookies are small text files placed on your device by a website. Galaxyglot sets one first-party cookie of its own, to keep you signed in - see section 2a. Everything else it needs to remember uses browser localStorage, a similar client-side storage mechanism, covered in section 2b. Cookies also reach your device from one third party, Google - when you use Google sign-in, and through the ad service behind the optional "watch an ad for a satellite" feature. Section 3 explains exactly when and why. This policy covers all three.
2a. The Cookie We Set
This is the only cookie Galaxyglot itself sets. Your browser sends it back to us automatically on every request; no script on this or any other site can read its value.
| Name | Category | Purpose | Expires |
|---|---|---|---|
galaxyglot_session |
Essential | Identifies your signed-in session to our server. Marked HttpOnly (no script can read it), Secure (sent only over https), and SameSite=Lax (never sent to other sites). Cleared when you sign out. |
30 days (server-enforced); rejected after that |
2b. What We Store in localStorage and Why
All of the entries below are written to localStorage in your own browser - a different mechanism from the cookie above, and one this page also covers. Nothing here is sent anywhere automatically - the entries marked Synced are also mirrored to your account on our servers so your progress follows you between devices.
Keys containing <scope> are written once per identity: guest before you sign in, and user:<your account id> afterwards. Keys containing <direction> are written once per course (for example en-sl), so progress in one language pair never mixes with another.
| Key | Category | Purpose | Expires |
|---|---|---|---|
galaxyglot.auth.v2 |
Essential | Holds a cached copy of your public profile, so the app can show you as signed in immediately on the next visit while it confirms your session cookie with the server. Holds no credential of any kind. Cleared when you sign out. | Until cleared; overwritten on each sign-in |
galaxyglot.progress.v3.<scope> |
Essential · Synced | Your per-word progress, spaced-repetition scheduling, which nodes you have visited, and your known-word and answer-streak counters. | Until you reset progress, delete your account, or clear browser data |
galaxyglot.progress.v3.history.<scope> |
Essential · Synced | A rolling window of your 50 most recent drill results, used for stats, sparklines and review scheduling. | Rolls over after 50 entries; cleared on reset |
galaxyglot.nodestate.v4.<scope>:<direction> |
Essential · Synced | Word mastery levels and per-node, per-mode completion counts for one course direction. | Until you reset that course, delete your account, or clear browser data |
galaxyglot.owner.v1.user:<id> |
Essential | A fingerprint of the account that owns the cached data on this browser (username and account creation date). It exists so that on a shared or reused browser one person's progress can never be shown to, or synced from, a different account. | Until cleared; overwritten on each sign-in |
galaxyglot.demoack.v1.<scope>.<lang> |
Functional | Records that you dismissed the notice shown for a language still in demo state, so it is not repeated on every visit. | Until cleared |
galaxyglot-settings |
Preference | Your preferences: accent colour, quiz mode, question count and language pair. | Until cleared |
galaxyglot-ui-lang |
Preference | Your chosen interface language. | Until cleared |
galaxyglot:theme |
Preference | Your chosen visual theme, including the Auto setting that follows the time of day. | Until cleared |
galaxyglot-level |
Preference | The difficulty level you last had active in the galaxy view. | Until cleared |
galaxyglot-onboarded:<userId> |
Functional | Records that you have finished the first-run onboarding tour. | Until cleared |
galaxyglot.anon.v1 |
Analytics (first-party) | A random identifier for the sign-up funnel, set before you sign in. Linked to your account and removed when you sign in; see the Privacy Policy, section 2. | Until you sign in or out |
galaxyglot-cookie-consent |
Essential | Records that you confirmed this Cookie Policy at sign-up. | Until cleared |
Some earlier versions of the app stored these keys under an older prefix. The next time you load the app, each of those is copied to the matching galaxyglot name and the original is deleted, so your settings and locally cached progress carry over. Keys written by still older versions - those prefixed galaxyglot.progress.v1, galaxyglot.progress.v2, galaxyglot.nodestate.v2 or galaxyglot.nodestate.v3, an old unprefixed theme key, and galaxyglot.auth.v1 (which held your session token directly, before it moved into the cookie described in section 2a) - are deleted rather than kept. We do not otherwise read any of them.
Apart from the first-party sign-up funnel identifier above, which never leaves Galaxyglot, Galaxyglot itself stores no analytics, advertising, profiling or cross-site tracking identifiers of any kind. Google's ad service, described in section 3, may store its own.
3. Third-Party Cookies and Scripts
Google Identity Services (sign-in)
Galaxyglot offers Continue with Google as an alternative to a password. To render that button we load Google's Identity Services script from accounts.google.com, and the button itself is an iframe served by Google. As a result:
- Google receives your IP address, browser and device information, and the address of the page the button appears on.
- Google may set and read its own cookies on Google domains, under Google's own privacy policy and cookie practices - not ours. We cannot read, control, or delete them.
- If you are signed in to a Google account in that browser, Google can recognise you at this point.
This happens only on the sign-in page, and only when Google sign-in is enabled on the server. It does not happen anywhere else in the app, and Google is not involved in your learning activity, progress or statistics.
Google's "One Tap" and automatic sign-in are deliberately switched off. No sign-in can complete without you clicking the button. If you click it, Galaxyglot receives from Google a signed token containing your Google account id, your verified email address, your name and your profile picture URL - see the Privacy Policy for what we then do with it.
To avoid Google entirely, register with an email address and password instead. Google's own handling of this data is described at policies.google.com/privacy.
Google AdSense (optional rewarded ads)
When you run out of satellites you can choose to watch a short video ad to get one back. Those ads are served by Google AdSense. To have an ad ready when you ask for one, we load Google's ad script from pagead2.googlesyndication.com while you are signed in. As a result:
- Google receives your IP address, browser and device information, and the address of the page.
- Google may set and read its own cookies and similar identifiers to serve, measure and limit ads, under Google's own policies - not ours.
- Where the law requires it (including in the EEA, the UK and Switzerland), Google shows a consent message first. If you decline, Google may still serve non-personalised ads, which rely on limited cookies for frequency capping, fraud prevention and reporting.
No ad is ever shown unless you press the button to watch one, and nothing is lost by not watching: satellites also come back on their own over time. We never send Google your name, email address, username or learning data. How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites, and you can manage ad personalisation at adssettings.google.com.
Everything else
Apart from Google AdSense above, we use no third-party analytics, advertising, or tracking services, and we embed no social media widgets or comment systems.
Text-to-speech uses either audio files served from our own servers or the Web Speech API built into your browser. In the latter case no data is sent to us, though your browser or operating system vendor's own policies may apply.
4. Categories and Your Consent
Essential entries are required for the Service to function: without them you would be signed out on every page load and your progress would be lost between sessions. Under applicable law these do not require your consent, though we still ask you to confirm this policy at sign-up as a transparency measure.
Functional and Preference entries remember choices you made yourself. They are written only as a result of your own action - picking a theme, dismissing a notice, finishing the tour - and never used to profile you.
Google's cookies are the only third-party storage involved, and they are set by Google, not by us. Those tied to Google sign-in are avoided by choosing an email and password account. Those tied to advertising are governed by the consent choice Google's consent message offers you, which you can change at any time under Settings - Session - Privacy and ad choices (shown wherever that message applies).
5. How to Control or Delete Storage
You can clear Galaxyglot's cookie and local storage at any time:
- Sign out - clears the
galaxyglot_sessioncookie and your cached profile from this browser. - In-app - use Settings → Reset Progress to clear progress data, or delete your account to remove all of it, locally and on our servers.
- Browser settings - most browsers let you view, clear, or block cookies and localStorage under Developer Tools → Application → Cookies / Local Storage, or via Settings → Privacy → Clear browsing data.
- Google's cookies - manage these through your browser's cookie settings and your Google Account settings at myaccount.google.com.
Note: because galaxyglot_session is HttpOnly, clearing localStorage alone does not sign you out - the app will simply re-fetch your profile using the cookie on the next visit. Clearing cookies (or using Sign out) is what actually ends your session. Either way, locally cached progress is erased, but progress already synced to your account on our servers is not affected and returns when you sign in again. Resetting progress does clear both - but achievements you have already unlocked are kept on purpose, because they record something you did rather than something that is still true.
6. Changes to This Policy
We may update this Cookie Policy if we introduce new storage mechanisms or third-party services. We will post the updated policy here and update the "Last updated" date above.
7. Contact
Questions about our use of cookies or localStorage: legal@galaxyglot.com.