Legal
Cookie Policy
Last updated 2026-10-01 · one necessary cookie, nothing that tracks you, and the audit that shows why no consent banner is needed
1. The short answer
We set one cookie, and it is one you asked for: the login session. It carries no advertising, analytics or tracking of any kind, it is not shared with anyone, and it is what the law calls strictly necessary — the service cannot work without it. Because of that, this site does not need a blocking consent banner for its own cookie, and you will not find one here.
What you get instead is this page, linked from the footer of every page and from the bottom of every form: a plain list of everything this site stores in your browser, why, and how to get rid of it. Where a non-essential thing does touch your browser — a YouTube or Vimeo player on a lesson, a Jitsi room for a live class — it happens only because you opened that lesson, and that is what consent looks like here: an action you took, described before you take it.
If you would still like a banner, switch on analytics, or embed social media pixels, the answer changes: those are not strictly necessary, and they would have to be blocked until you agreed. Section 6 lists what would flip the answer.
2. What a cookie actually is
A cookie is a small text file a site asks your browser to keep and send back with the next request to that site. It is how a site recognises that two page views come from the same person — and for a login, that is the whole trick. Cookies can only be read by the site that set them (first-party), or by a third party whose content you loaded and that set its own cookie from its own domain.
Modern browsers also offer localStorage and sessionStorage: places in your browser that hold data but are never sent automatically with a request. The law treats them the same as cookies when they identify you or your device, so they are listed here too — even the harmless ones, so that this page is complete rather than minimal.
3. The one cookie we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
PHPSESSID | Keeps you signed in and remembers the page state that makes the app safe to use: your user id, the single-use security token on every form (otherwise a form could be submitted from another site), the "problem" message shown after a redirect, and the answer to the human check while a registration form is open. No name, e-mail address or content is stored in the cookie itself — only an opaque id that matches a record on our server. | Strictly necessary — exempt from consent (ePrivacy Directive Art. 5(3) / PECR reg. 6; RA 10173 on consent for necessary processing). Block it and you simply cannot log in. | Until you close the browser (the value on the server behind it expires earlier when the session times out, and logging out destroys it immediately). |
The attributes are fixed in code, so this description stays true: HttpOnly (scripts cannot read it, so an injected script cannot steal your session), SameSite=Lax (it is not sent on a form submitted from another website — the standard defence against cross-site request forgery), Path=/ (the whole site), and Secure, which the server adds by itself whenever the site is reached over HTTPS.
We set no analytics cookie, no advertising or remarketing cookie, no social-media pixel, and no cookie that follows you to another website.
4. What we keep in your browser storage (no cookie, still listed)
| Key | Where | What it is for | How long |
|---|---|---|---|
lh-cookie-notice | localStorage | Remembers that you dismissed the one-line notice about this policy, so it does not reappear on every page. Set only when you press "Got it". | Until you clear your browser data. |
lh-rail | localStorage | Whether you collapsed the sidebar to icons or kept the full menu — a display preference, written only when you click the toggle yourself. | Until you clear your browser data. |
lh-scheme | localStorage | Whether you switched the page to its dark colours or left it light, from the sun/moon button in the top bar. Again a display preference and nothing else — it is not tied to your account, is not sent to the server, and is read back by the page before it first paints so the page does not arrive light and change afterwards. | Until you clear your browser data. |
lh-lessons-tab | sessionStorage | Which tab of the lessons panel (video, notes, upload…) you were looking at, so a reload does not jump back to the first tab. | Until the tab is closed. |
lh-challenge-reload | sessionStorage | A timestamp that stops the app reloading itself more than once every 45 seconds when a shared host answers a background request with its own anti-bot page. Pure housekeeping. | Until the tab is closed. |
None of these keys contains personal data, none of them leaves your browser, and none is read by us. We list them because a complete inventory is more useful than a clever one.
5. Cookies set by services we load
These appear only in the situations named, and they come from the other company's domain — we never receive them:
| Service | When it loads | What it may store |
|---|---|---|
| Cloudflare Turnstile (bot check) | Only on the log-in, registration and password-reset forms, and only while the administrator has Turnstile switched on. With it off, those forms use the built-in arithmetic question and no third party is contacted. | Cloudflare's own cookies such as cf_clearance, __cf_bm and _cfuvid, used to decide whether the visitor is a human being and to keep that answer briefly. Security, not advertising. |
| YouTube (privacy-enhanced mode) / Vimeo | Only when a lesson contains a video link and you open it. Lesson videos uploaded by your teacher are streamed from this site instead and involve nobody else. | Whatever the player sets once you press play — typically playback preferences and a device identifier. Embedding them is what makes the video work; if you do not press play, the player stays silent. |
| Jitsi / 8x8 (live class) | Only while you are in a live class room on the server your school configured. | Session and device data needed to hold the call open, plus your display name inside the room. |
| Shared-hosting anti-bot challenge | Only if the web host chosen for this installation answers a request with its own "enable JavaScript" challenge page. | That host's clearance cookie, which lets the following requests through. |
Nothing above is loaded on the home page or on any page you did not ask for. There are no advertising networks, no social plug-ins, no heat-map or session-recording scripts.
6. So — do we need a cookie consent banner?
| Question | This site | Consequence |
|---|---|---|
| Does the site set any cookie of its own? | One — the login session. | Disclosure is enough; a banner is not required for it. |
| Can the site work without it? | No. Without the session cookie, logging in is impossible (and so is the anti-forgery token on every form). | It is strictly necessary — the exemption in Art. 5(3) of the ePrivacy Directive and reg. 6 of the UK PECR. |
| Does anything track you across websites, or build a profile? | No. No analytics, no pixels, no advertising or social plug-ins. | There is nothing to ask consent for. |
| Is anything loaded from a third party without you asking? | Page fonts (Google Fonts), and Cloudflare Turnstile while the human check is on. Both are disclosed above; neither follows you across sites. | Disclosure and a lawful basis are needed (see the Privacy Policy). Under a stricter reading, self-host the fonts — the page then contacts nobody. |
| Are the non-essential players loaded on their own? | No. A YouTube/Vimeo player appears only inside a lesson that uses such a link, and Jitsi only when a live class is opened. | Opening the lesson is the visitor's own action, and the Privacy Policy explains it beforehand. |
| Is data sold or shared for advertising? | Never. | No "sale/share" opt-out notice is needed. |
| What would change the answer? | Adding analytics (Google Analytics, Meta Pixel, Hotjar…), advertising, a chat widget, or any cookie that survives to recognise you on another site. | Then those scripts must be blocked until the visitor agrees — a real banner, with an equally easy "reject". |
Until such a tool is added, the honest position is: one necessary cookie, disclosed, plus a one-line notice in the footer that links here. No dark patterns, no "accept-all" wall, and nothing to withdraw.
7. Not cookies, but still worth knowing
- Google Fonts. The typefaces are fetched from Google's CDN, so your browser makes a request to Google and your IP address is visible there. That request sets no cookie. A school that wants zero contact with Google can self-host the two fonts; the pages look identical.
- Your e-mail address. When we send you a notification, the address and the message pass through the e-mail service our administrator configured (Brevo, SendGrid or Resend). That is a transfer of personal data to a processor, described in the Privacy Policy — not a cookie.
- Server logs. Our own error log records what went wrong, and an attendance record keeps the IP address it was taken from. Neither is a cookie, and neither is used to follow you.
8. How to see, block or delete what is stored
Every mainstream browser lists what a site has stored and lets you delete it, or block cookies per site — look under Settings → Privacy and security → Cookies and site data (Chrome / Edge), Settings → Privacy & Security (Firefox), or Settings → Safari → Advanced (Safari). Private or incognito windows keep the session cookie only until the window is closed.
One practical warning: blocking the session cookie, or clearing it while you are signed in, signs you out and stops forms from submitting (the security token inside the form no longer matches your session). That is the cookie doing exactly the job described above.
For the third-party players in section 6, deleting the cookies they set, using your browser's tracking protection, or choosing never when a video platform asks about storage settings are all effective. You can also simply not press play — the lesson text and your teacher's uploaded files never depend on it.
9. Changes, and how to ask us something
The "Last updated" date at the top of this page shows the current version, and a material change is announced here — with fresh consent where the law requires it.
Questions about cookies or about your data: e-mail fttccatbalogan@gmail.com, or ask at the school office — Felices Technological Training Center, Inc., 6th St. Brgy 12 Patag, Catbalogan City, Samar, 6700 · 0917 320 2508.
Read next: Privacy Policy · Terms & Conditions · Cookie Policy.