legal
Cookie Policy
- version
- 1.0
- effective
- 2026-10-20
- updated
- 20 October 2026
- read ~5 min
01Introduction
1.1.This Cookie Policy forms part of our Privacy Notice. It describes the cookies and similar technologies, such as browser local storage and session storage, that we use on duckurity.com and the Duckurity Academy.
1.2.We do not use cookies or similar technologies for advertising or for tracking you across other websites.
02duckurity.com
2.1.duckurity.com sets no cookies. Fonts are served from our own domain, so no request is made to Google or any other font service.
- Name
intro-seen - Type
- Local storage (functional)
- Purpose
- Records that the introduction has been shown, so that it is not shown again
- Duration
- Until cleared by you
03Duckurity Academy
3.1 Cookies
Every Academy cookie can be read only by academy.duckurity.com and is sent only over encrypted connections.
- Name
__Host-duck. keycard - Type
- Strictly necessary
- Purpose
- Keeps you signed in. Not accessible to scripts on the page.
- Duration
- 7 days, renewed on each day of use, and never more than 30 days after you signed in; removed when you sign out
- Name
__Host-duck. browser - Type
- Strictly necessary (security)
- Purpose
- Holds a random value that lets us recognise a browser you have used before, so that we can alert you when your Account is signed in from a new one. We keep only a keyed hash of the value. Not accessible to scripts on the page.
- Duration
- 400 days; kept when you sign out
- Name
__Host-duck. passkey- sign- in - Type
- Strictly necessary
- Purpose
- Links a passkey sign-in to the browser that started it
- Duration
- 5 minutes
- Name
__Host-duck. state - Type
- Strictly necessary
- Purpose
- Protects a sign-in with GitHub, or the linking of a GitHub account, against forgery
- Duration
- 5 minutes
- Name
__Host-duck. prefs - Type
- Preference
- Purpose
- Remembers the display choices you make in your account settings, such as text size, motion and keyboard shortcuts
- Duration
- 365 days from your last change; kept when you sign out
- Name
__Host-duck. organization - Type
- Preference
- Purpose
- Remembers which of your Organizations the sidebar shows
- Duration
- 365 days; removed when you sign out
3.2 Local Storage
The following items remain on your device and are not sent to us.
| Name | Type | Purpose |
|---|---|---|
sidebar | Preference | Remembers whether you have hidden the sidebar |
theme | Preference | Remembers whether you selected the light, dark or system theme |
notice | Preference | Remembers the last announcement you dismissed |
duck. | Preference | Remembers how you last signed in on this browser, so that the sign-in page can point to it |
3.3 Session Storage
The following items remain on your device, are not sent to us, and are deleted when you close the tab.
- Name
duck.sign- in. pending- code - Type
- Strictly necessary
- Purpose
- Keeps the email address you entered and the time your sign-in code was sent, so that reloading the page does not lose your place
- Duration
- Until you sign in or sign out
- Name
retry:<page>- Type
- Strictly necessary
- Purpose
- Counts how many times a page that failed to load has been retried automatically
- Duration
- 5 minutes
3.4 Bot Protection
The sign-in page uses Cloudflare Turnstile to verify that sign-in requests come from people rather than automated scripts. Turnstile runs on the sign-in page and sends Cloudflare information about your browser and your IP address. It is used solely to protect sign-in. Cloudflare's privacy policy is available at https://www.cloudflare.com/privacypolicy/.
3.5 Analytics
We do not currently use analytics cookies. If we introduce product analytics, we will update this policy and set analytics cookies only after you have accepted them, as described in section 4.
04Your Consent and Choices
4.1.Everything described in this policy is either strictly necessary to provide the Service you request, such as keeping you signed in, protecting your Account and protecting sign-in, or remembers a choice you made. We therefore use these items without asking for your consent.
4.2.We will ask for your consent before setting any other cookie or similar technology, such as for analytics. When we do, a banner will let you accept all optional items, reject all of them, or choose by category. Rejecting will be as easy as accepting, and no optional item will be set before you make a choice. You will be able to change or withdraw your consent at any time through a "Cookie settings" link at the bottom of every page, and we will keep a record of each choice, with its date and the version of this policy.
4.3.You can delete cookies, local storage and session storage through your browser settings. Deleting the __Host- cookie will sign you out. Deleting the __Host- cookie means that your next sign-in from that browser will be treated as a sign-in from a new browser, and we will send a security alert to your email addresses. Deleting the other items will reset your preferences.
05Contact
Questions about this policy may be sent to privacy@duckurity.com.