Cookie policy
Updated
Private School uses the storage below for features you choose. The directory application does not install advertising or optional analytics cookies.
Cookies and browser storage we use
school_shortlist
Type and provider: essential first-party cookie, set by Private School when you save or remove a school while signed out.
Purpose: a random token lets the server retrieve your saved-school list. The server stores its hash and school IDs; the cookie contains no name or email.
Lifetime: 30 days, renewed after a save or removal. Server records expire at the same time and are deleted during subsequent shortlist changes.
Protection: HttpOnly, SameSite=Lax and Secure on HTTPS. Browser scripts cannot read this cookie.
school-comparison
Type and provider: first-party session storage in your browser tab, written by Private School when you select or clear comparisons.
Purpose: remembers up to three selected school IDs as you move between pages.
Lifetime and control: the tab session. Use “Clear” in the comparison bar to remove the selected IDs. Browser session restoration can retain session storage.
school-display-currency-v1
Type and provider: first-party session storage, written by Private School when you choose a fee-display currency.
Purpose: remembers your selected local currency, USD, EUR or GBP during navigation.
Lifetime and control: the tab session. Choose “Local” to return to published local fees, or clear the site’s browser data. Browser session restoration can retain session storage.
__Secure-private-school.session_token
Type and provider: essential first-party cookie, set by Private School after successful sign-in.
Purpose: a signed session identifier lets our server validate your account session. The server stores the session record; the cookie does not contain your password.
Lifetime and control: up to seven days from sign-in. Signing out revokes the current server session and removes its cookie. Clearing this cookie signs this browser out, while account records and saved schools remain until separately deleted.
Protection: HttpOnly, Secure and SameSite=Lax on the public HTTPS website. Session-cookie caching in the browser is disabled; access is checked against server records.
__Secure-private-school.state
Type and provider: essential first-party cookie, set by Private School when you start Google sign-in.
Purpose: binds the Google callback to the sign-in request from this browser and helps prevent forged sign-in requests.
Lifetime and protection: up to five minutes, removed during completion of sign-in; HttpOnly, Secure and SameSite=Lax.
Why there is no optional-cookie banner
Under § 25 TDDDG, storing or accessing information on your device generally requires informed consent. § 25(2)(2) permits storage strictly necessary for a digital service you expressly request. The application storage above is limited to your requested saved-school, comparison, currency and sign-in functions, so it does not require an optional-cookie opt-in.
Where personal data is involved, its processing must also have a GDPR legal basis. Our privacy policy explains that processing separately. If optional tracking or other non-essential storage is introduced, it must remain disabled until you consent, with a way to refuse and withdraw consent.
Hosting, sign-in and external websites
Hostinger provides the website hosting infrastructure. Google sign-in redirects you to Google to authenticate and returns you to this website. Google’s own cookies and account processing are described in its privacy policy; we do not load Google advertising or analytics scripts for sign-in.
Following a school link, or opening Stripe Checkout if a paid service is separately agreed, takes you to another service. Its cookies and privacy rules apply there. We do not embed school tracking, external maps, video players or Stripe payment fields into the directory pages.
Your controls
While signed in, saved schools are stored under your account rather than this random browser token. They remain available after you clear browser data. Remove them using their saved-school controls, or request account deletion through the privacy contact. Importing an existing browser shortlist into your account requires your explicit action.
You can block or delete cookies and session storage using your browser’s site-data settings. Blocking essential storage can prevent saved lists or preferences from working. Clearing a shortlist cookie removes access to its server records; those records expire and are cleaned up as described above. Questions about storage or your data can be sent to the contact in the imprint.
Legal reference: § 25 TDDDG.