Cookies and tracking
Version 1.0 | Last updated: 20 September 2026
We keep this short because there is not much to say about our own website. It does not run analytics, does not record your visit, and does not use advertising or tracking tools of any kind. There is no banner because our website has nothing to ask you.
What our website does set is one cookie, and only if you have an account. It keeps you signed in, and it lasts 30 days or until you sign out. It is strictly necessary, so the law does not require your consent for it.
When you pay, you leave our website for the secure payment page of our payment provider, Stripe. Stripe sets its own cookies there to prevent fraud and to check that you are a person and not a program. Those cookies are set on Stripe’s addresses, not ours, and Stripe’s cookie policy explains them: stripe.com/cookies-policy/legal.
Our Reflection quiz is provided by ScoreApp and appears inside one of our pages. Nothing from ScoreApp loads until you press Start. When you do, ScoreApp sets the cookies listed below. Two keep the quiz working and secure. One, called _score, recognises you if you come back, and ScoreApp itself does not class it as essential. You can delete it from your browser when you have finished.
Our member community, Inside the Loop, runs on Circle at community.theconfidentlearningco.org. Circle sets cookies to sign you in and keep you signed in. Circle also runs its own analytics inside the community, including a tool called Contentsquare, and we want to be plain about what we found when we checked. Circle sets those analytics cookies before you answer its cookie banner, and they stay if you press Decline all. The banner is Circle’s, and we cannot change how it works. We are pressing Circle to put this right and we will update this page when they answer. Circle’s cookie policy is at circle.so/cookie-policy. We add no tracking of our own to the community.
If you have a question about any of this, email privacy@theconfidentlearningco.org. Our Privacy Policy explains what we do with your information and how to complain, including to the Information Commissioner’s Office.
The list below shows what is set, by whom, and for how long. It was checked on 20 September 2026.
Cookie inventory
| Where | Name | Set by | Purpose | Lifetime | Category |
|---|---|---|---|---|---|
| Website | cl_session | The website | Keeps you signed in to your website account | 30 days | Strictly necessary |
| Reflection page, after Start | scoreapp_session | ScoreApp | Keeps the quiz session going | Not published by ScoreApp | Essential to the quiz |
| Reflection page, after Start | XSRF-TOKEN | ScoreApp | Protects the quiz against forged requests | Not published by ScoreApp | Essential to the quiz |
| Reflection page, after Start | _score | ScoreApp | Recognises a returning visitor and links later visits to the first | Not published by ScoreApp. Set to expire in 2027 when checked | Not essential, by ScoreApp’s own account |
| Reflection page, after Start | __cf_bm, _cfuvid | Cloudflare, for ScoreApp | Security: tells people from automated traffic | 30 minutes; session | Strictly necessary |
| Reflection page, after Start | __cf_bm, __cflb | Cloudflare, for hCaptcha | Security check that you are a person | 30 minutes; up to 24 hours | Strictly necessary |
| Payment, on Stripe’s own page | __stripe_mid, __stripe_sid, m | Stripe | Fraud prevention | 1 year; 30 minutes; up to 2 years | Strictly necessary. Set on Stripe’s addresses |
| Payment, on Stripe’s own page | Others from Stripe’s security partners, and one from Google because Google Pay is offered | Stripe’s partners; Google | Bot detection; Google Pay | See Stripe’s cookie policy | Set on Stripe’s addresses |
| Community | _circle_session, remember_user_token, user_session_identifier, csrf_token | Circle | Sign-in and session | Session to 1 year | Strictly necessary |
| Community | browser_time_zone, cookies_enabled, circle_gdpr_cookies_enabled | Circle | Remembers your time zone and your answer to Circle’s banner | Session to 1 year | Strictly necessary |
| Community | __cf_bm, cf_clearance | Cloudflare, for Circle | Security | 1 hour; 1 year, by Circle’s figures | Strictly necessary |
| Community | __stripe_mid, __stripe_sid | Stripe, for Circle’s paywall | Fraud prevention | 1 year; 30 minutes | Strictly necessary |
| Community | ahoy_visit, ahoy_visitor, utm_params | Circle | Visit tracking, and where you arrived from | 1 day; 2 years; session | Analytics. Circle lists them as strictly necessary. Set before its banner is answered and kept after Decline all |
| Community, set on our root domain | _cs_id, _cs_s, _cs_c | Contentsquare, for Circle | Analytics of how the community is used | 13 months; 30 minutes; 13 months | Analytics. Not in Circle’s published policy. Set before its banner is answered and kept after Decline all |
| Community | Others seen on inspection whose purpose Circle has not published, including _ruid | Circle | Not published | Not published | Asked of Circle |