Cookie Policy

GlassBound LLC, a Texas limited liability company, runs glassbound.net (the "Service"). This page lists every cookie and browser-storage item the Service uses, and why. Questions: support@glassbound.net.

The first time you visit, we ask whether you allow analytics. Until you click "Accept analytics", PostHog records nothing and stores nothing in your browser. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a "no" and do not ask. You can change your choice at any time: Cookie settings.

Declining does not remove any feature. We never sell your data or use it for advertising, and we have no advertising cookies.

These keep the Service working. They are stored in your browser only.

• Sign-in session (sb-…-auth-token, local storage, set by Supabase): keeps you signed in. Removed when you sign out.
• Your analytics choice (gb:v1:analytics-consent, local storage): remembers whether you accepted or declined analytics.
• Account safety on shared devices (gb:v1:progress-owner, local storage): makes sure one account's saved progress is never shown to the next person who signs in on the same device.
• Sign-up hand-off (gb:v1:invite-code, gb:v1:invite-prefill, gb:v1:signup-username, gb:v1:chapter-join, gb_username, session storage): carries your invite or chapter link through email confirmation. Cleared when you close the tab.
• Sign-up age check (gb_signup_cooldown cookie and gb:v1:signup-age-cooldown, local storage): if the age check at sign-up does not pass, stops the form being tried again from this browser for 24 hours. Holds only the time it expires.
• Analytics-choice flag (__ph_opt_in_out_<project key>, set by PostHog's library): remembers whether PostHog is allowed to capture. It holds only that yes-or-no value.
• Feature-rollout override (adaptiveStudyPlan.override.…, session storage): set only when a GlassBound operator opens a test link.
• Microphone-permission reload (rp-mic-policy-reload, session storage): reloads the page once if your browser's microphone setting changes. Used only by roleplay practice.
• Update recovery (preload-reload, session storage): reloads the page once if a new version of the Service was released while it was open.

These remember your settings and study progress on this device so the app works offline-first and picks up where you left off. They never leave your browser except as part of your own account data. All start with gb:. Signing out does not remove them; they are deleted when a different account signs in on this device.

• Light or dark theme (gb:v1:theme-mode).
• Your chosen DECA event and study path (gb:v2:active-event, gb:v2:active-path).
• Study progress: practice rounds, practice tests, review queue, missed questions, streak, onboarding answers and diagnostic results (for example gb:v3:round-session, gb:v1:practice-test-attempts, gb:v1:review-queue, gb:v1:missed-questions, gb:v1:study-streak).
• Unsent drafts of comments on a review set (gb:v1:review-set-comment:…).
• Small interface notices and collapsed sections.

• PostHog (PostHog Inc., US cloud): cookie and local-storage item ph_<project key>_posthog, plus session-storage items starting ph_. Holds a random visitor ID and session ID so we can see which pages and features are used and where errors happen. Expires after one year. When you are signed in, activity is linked to your account's random ID, never your email or name. No session recordings.

Without your OK, the PostHog script still loads so that features we are rolling out gradually work the same for everyone, but it runs opted out: it captures no events and keeps nothing in your browser. That request for feature settings still sends your IP address and a random ID (your account's random ID if you are signed in) to PostHog. If you decline after accepting, the PostHog cookie and storage are deleted.

Our host, Vercel, counts page visits (page, referrer, country, browser and device type) with Vercel Web Analytics. It sets no cookies and stores nothing in your browser, and it cannot follow you across sites.

The beta-tester map loads a US-states outline file from the jsDelivr CDN, which sees your IP address like any web request. It sets no cookies. Fonts are served from our own domain.

How we use personal information, and your rights, are in our Privacy Policy. The rules for using the Service are in our Terms of Service.