StudyDerm Cookies and Storage Notice
Last updated: 24 October 2026
1. Short version
1.1 StudyDerm sets no cookies.
1.2 We store a small number of items in your browser's local storage so the app works, keeps you signed in, saves your progress, remembers the settings you chose and keeps answers you make offline until you reconnect. Signing out does not remove your progress from the device (section 3.4).
1.3 We use no analytics, advertising or tracking cookies or scripts on studyderm.app or my.studyderm.app. Because of that, we do not show a cookie consent banner.
1.4 If that changes, we will update this notice and our Privacy Policy first, and ask for your consent where the law requires it.
2. What "local storage" is
2.1 Local storage is a small area in your browser where a website can keep data on your device. Unlike a cookie, the browser does not attach it to requests automatically.
2.2 Our app reads it and, when you are signed in, sends the sign-in token and your answers to our server as part of normal use of the service.
3. What we store on your device
The app (my.studyderm.app) uses the following keys, all in local storage except sce2.ended, which is in session storage (it lasts only while the browser tab is open). The marketing site (studyderm.app) stores nothing on your device.
| Key | What it holds | Purpose | Type | How long it lasts |
|---|---|---|---|---|
sce2.auth | A random sign-in token. Not your email address. | Keeps you signed in | Strictly necessary | Until you sign out or the app finds the session has ended (the token expires 30 days after last use, 90 days at most). |
sce2.u.<your user id> | A local copy of your progress and settings: XP, streak, answers, current session, preferences (such as sound and daily goal), and an optional challenge display name. The display name stays on your device. | Saves your progress and keeps answers you make offline until you reconnect; remembers your preferences | Strictly necessary | Until you clear your browser's site data. Signing out does not remove it (section 3.4). |
sce2.u.<your user id>.outbox | Answers waiting to be sent when you are offline | Sends your offline answers once you reconnect | Strictly necessary | Removed once sent. Unsent items older than 3 days are dropped. |
sce2.u.<your user id>.sync | A version marker for your saved progress | Keeps progress in step across your devices | Strictly necessary | Until you clear your browser's site data. |
sce2.u.<your user id>.imported | A marker that older local progress has already been added to your account | Stops the same progress being imported twice | Strictly necessary | Until you clear your browser's site data. |
sce2 | Progress from an earlier version of the app, only if your browser already holds it | Read once so we can offer to add it to your account | Strictly necessary | Until you clear your browser's site data. |
sce2.termsNotice | Which notice of a coming change to our terms you closed | Stops the same notice showing again once you have closed it | Strictly necessary | Until you clear your browser's site data. Signing out does not remove it. |
sce2.ended | A marker, in session storage (this browser tab only), that your sign-in session ended | Tells you on the sign-in screen that your session ended, rather than showing it blank | Strictly necessary | Removed when the sign-in screen has shown the message, or when you close the tab. |
3.1 The access token that proves who you are to the server is kept in memory only. It disappears when you close or reload the page.
3.2 Paid content and images are held in memory only while you use the app, and are cleared when you sign out.
3.3 Challenge links you create carry your optional display name and scores in the part of the link after #. Your browser does not send that part to us. Anyone you share the link with will see it.
3.4 Signing out leaves your progress stored on the device. Signing out removes your sign-in token (sce2.auth) and the content held in memory. The local copy of your progress and settings (sce2.u.<your user id> and the related keys above) stays in that browser. To remove it, clear the site data for my.studyderm.app in your browser settings. Do this on any shared or public computer. Clearing site data removes everything in this section, including offline answers that have not yet been sent.
4. Why we do not ask for consent
4.1 UK law (regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, "PECR") says that, in general, information may only be stored on or read from your device with your consent. Schedule A1 to PECR sets out exceptions.
4.2 Strictly necessary storage (Schedule A1, paragraph 4). Storage that is strictly necessary to provide the service you asked for does not need consent. We rely on this for signing you in, saving your progress, recording the settings you chose (such as sound and daily goal) and keeping answers made offline: sce2.auth, the progress held in sce2.u.<your user id>, the .outbox, .sync, .imported and sce2 keys, sce2.termsNotice (so a terms notice you closed stays closed) and sce2.ended (so the sign-in screen can tell you your session ended).
4.3 We use local storage only for these purposes. We do not use it to track you across sites or to build advertising profiles.
5. Other people's cookies and storage
5.1 Stripe. When you buy a plan you are sent to Stripe's hosted checkout page and, to manage billing, Stripe's customer portal. Those pages are run by Stripe as an independent controller and may set Stripe's own cookies or storage, which we do not control. See Stripe's own privacy and cookie information.
5.2 Cloudflare. Cloudflare delivers the files for studyderm.app and my.studyderm.app for us. We do not use Cloudflare's analytics features.
5.3 API. Our study service at api.studyderm.app sends no cookies. It identifies you with a token sent in a request header.
5.4 Marketing site. The marketing site loads its own style, script and image files from our own site and makes no requests to any other site. Its script fills in the brand name, the page title and the link addresses, and shows a countdown of days to the exam date, worked out from your device's date.
6. Analytics and advertising
6.1 There are no analytics, advertising, social media or tracking cookies, pixels or scripts on StudyDerm. The security policy we send with every page blocks scripts and other resources from third-party hosts.
6.2 We do not use error-monitoring or session-replay tools in the browser.
6.3 If we add analytics in future, we will update this notice before we start, explain what it collects and why, and ask for your consent where the law requires it.
7. Your choices and contact
7.1 Because we only use strictly necessary storage (section 4), there is nothing to switch off in a banner. Clearing site data in your browser settings removes what is stored on this device.
7.2 Questions about this notice: privacy@studyderm.app. For how we handle personal data generally, including your rights and how to complain, see our Privacy Policy.
8. Changes
8.1 We will update this notice when our use of storage changes, and show the date at the top.