COOKIE POLICY
LAST UPDATED: SEPTEMBER 2026 · ePRIVACY DIRECTIVE 2002/58/EC · PECR · CCPA
1. What are cookies?
Cookies are small text files stored on your device when you visit a website. “Similar technologies” include localStorage, sessionStorage, IndexedDB, tracking pixels, SDK identifiers, and device fingerprints. This policy covers all of them.
2. Categories of cookies we use
| Category | Purpose | Consent |
|---|---|---|
| Strictly Necessary | Sign-in session, authentication tokens, security (CSRF), load balancing, cookie-consent record itself | Not required (essential) |
| Functional | Language, theme (light/dark), tab selection, progress continuity across sessions | Required (opt-in) |
| Analytics | Cookieless page and event measurement (Plausible) and error reports (Sentry), which store nothing on your device; and Google Analytics, which sets cookies | Plausible and Sentry: on unless you reject analytics (or your browser sends Global Privacy Control). Google Analytics: only after you accept (opt-in) |
| Marketing | Not currently used. Reserved for referral tracking if ever enabled — would require fresh consent. | Required (opt-in) |
3. Specific items stored on your device
| Name | Category | Type | Retention | Purpose |
|---|---|---|---|---|
| ap2_cookie_consent | Necessary | localStorage | 12 months | Your cookie choices |
| ap2_u, ap2_db | Necessary | localStorage | Until you sign out or delete your account | Signed-in account (name, email, plan) and a revocable device token. No password is stored. |
| ap2_did, ap2_sid | Necessary | localStorage / sessionStorage | Persistent / session | Random device and session identifiers used to keep accounts secure and detect account sharing |
| ap2_prog, ap2_act, ap2_sr, ap2_qerr, ap2_recent | Necessary for the features you use | localStorage | Persistent (synced to your account when signed in) | Quiz progress, activity streak, spaced-repetition schedule, questions you got wrong, recent banks |
| ap2_flags, ap2_reviews, ap2_bookmarks, ap2_reports | Necessary for the features you use | localStorage | Persistent | Questions you flagged, bookmarked or reported |
| ap2_theme, v1_exam_set, ap2_nudge, ap2_yearlyBannerDismissed | Functional | localStorage | Persistent | Light or dark theme, exam-simulator choice, and which tips or banners you have already seen |
| v1_cv_draft | Functional | localStorage | Until you press Clear all or clear your browser data | Your draft on the Pilot CV Builder page, kept only in your browser; sent to v1prep only if you press Send my CV |
| v1_tool_uses_fdp, v1_tool_uses_metar, v1_tool_uses_xwind, v1_tool_uses_da | Functional | localStorage | Until you clear your browser data | How many of the 3 uses without an account of the Max FDP/Fatigue Calculator, the METAR and TAF decoder, the Crosswind Calculator and the Density Altitude Calculator this browser has had (a number only) |
| ap2_intent | Functional | localStorage | 30 days | The plan you opened checkout for, so a returning visitor can be offered a discount |
| Plausible Analytics | Analytics | None (cookieless) | — | Page views and events without cookies or personal data; switched off if you reject analytics |
| Sentry | Analytics | None on your device | — | Error reports so we can fix bugs; switched off if you reject analytics |
| _ga, _ga_T5SJ66ZXJC | Analytics | Cookie (Google Analytics) | Up to 2 years | Distinguish visitors and sessions so we can see which pages help; set only if you accept analytics, advertising features off |
This list is kept up to date. Some items may be absent depending on your configuration.
4. Legal basis for cookies
Under the ePrivacy Directive 2002/58/EC (as amended) and its national transpositions (e.g. UK PECR, France Loi Informatique et Libertés), strictly necessary cookies may be set without consent; all other cookies require prior informed consent. Under GDPR, where cookies involve personal data, the cookie consent also forms the lawful basis for that processing.
5. How to give, refuse or withdraw consent
On your first visit you see a banner letting you Accept All, Reject All or open Cookie Preferences to choose per category. Refusing is as easy as accepting. You can change your mind anytime via the Cookie Settings link in the footer; rejecting analytics stops Plausible, Sentry and Google Analytics from loading from your next page view (Google Analytics never loads unless you accept). On the guide and Library pages a small bar asks the same question until you choose. The items marked necessary are what the sign-in and study features themselves need, so they are kept whatever you choose.
You can also manage cookies via your browser settings (delete, block, prompt). Note that disabling strictly-necessary cookies will prevent the Service from working.
6. Global Privacy Control & Do Not Track
We honour the Global Privacy Control (GPC) browser signal where recognised by law (California, Colorado, Connecticut). If we detect a GPC signal we will treat it as an opt-out of “sale”/“sharing” under CCPA/CPRA and as withdrawal of non-essential cookie consent. We do not currently act on the legacy DNT header because no consistent standard exists.
7. Third-party cookies
We do not serve third-party advertising cookies. Third-party services (Gumroad checkout, Firebase) may set their own cookies on their domains during payment or authentication flows; their policies apply: Gumroad, Google Firebase.
8. Changes
We keep this list up to date. Significant changes are notified via the banner or email. See the “Last updated” date above.