Cookie Policy

Updated October 4, 2026

Cookies are small values stored in your browser. DropThatClass separates essential cookies from optional preferences and measurement. Rejecting optional cookies does not block reviews or sign-in.

Essential cookies

• Auth.js session, CSRF, and callback cookies support sign-in and protect authentication. Names may include authjs.session-token, authjs.csrf-token, and authjs.callback-url, with secure prefixes or chunk suffixes. Session cookies can persist for up to the configured session lifetime, currently 30 days. Other auth cookies may last only for the browser session.
• dtc_consent records your categories and choice time for 180 days, including rejection. It contains no account identifier.

Optional preferences

dtc_theme and dtc_accessibility remember light/dark appearance and high contrast with reduced motion for 180 days. These are written only after preference consent. Without consent, you can still change appearance for the current visit. Legacy theme local storage is cleared when you save choices.

Optional measurement

dtc_visits stores a local page-view count for 30 days, with no random visitor identifier. After measurement consent, the app sends only an allowlisted page path to its own server. No query strings, account IDs, review text, or email addresses are included. The server increments daily totals in MongoDB and expires them after 180 days. These totals are not unique visitor counts. Operational logs and abuse-prevention counters are separate from these totals.

Your choices

Use Cookie & accessibility settings in the footer, or Privacy & accessibility in the app menu, at any time to reject, accept, or customize optional categories. Rejection deletes the optional cookies and stops new measurement. It does not undo already aggregated page-view totals. Browser Do Not Track and Global Privacy Control signals disable optional measurement. Clearing cookies or using another browser/device requires a new choice.

No advertising or cross-site tracking cookies are added by this implementation. Hosting/proxy security services may set their own essential security cookies. Read Privacy Policy and Accessibility.