1.What cookies are
A cookie is a short piece of text your browser stores and sends back with every request to the same site, letting the server recognise your session. Alongside cookies we use local storage, which stays in the browser and is never sent to the server — we use it for interface preferences, and for local copies and drafts of what you type yourself: your basket, your lesson notes and your instructor application.
Everything we write ourselves is first-party (the ataa.ai domain). The only exception is the advertising identifiers in the marketing section below: written by Meta's and Snap's tools onto our domain, and never loaded before your consent.
2.Strictly necessary
Without these the site does not work properly, and they cannot be turned off from inside the platform. They need no prior consent because they are required to deliver the service you asked for. Cookies marked HttpOnly cannot be read by page scripts at all.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| ataa_at | Cookie (HttpOnly) | The access token that authenticates your session on every request. Deliberately short-lived so a leaked copy is of little use. | 15 minutes |
| ataa_rt | Cookie (HttpOnly) | Renews your session without asking for the password again. It is sent only to the sign-in routes under /api/v1/auth, so it never appears in any other request. | 30 days |
| ataa_sr | Cookie (HttpOnly) | A single marker saying this browser holds a session that can be renewed, so we can pick your session back up instead of asking you to sign in again after a quiet spell. It carries no token and grants nothing on its own, and it is deleted when you sign out. | Same as the renewal cookie (30 days; 1 hour for admin accounts) |
| ataa_oas / ataa_oav / ataa_oar | Cookies (HttpOnly) | The Google sign-in handshake: the anti-forgery state, the PKCE verifier, and where to return after signing in. Written only while you sign in with Google. | 10 minutes |
| ataa_consent | Cookie | Records your choice per category (analytics / advertising), when you made it, and which version of this policy you answered — so you are not asked on every visit, and if we add a new kind of tool we ask about that one only. It carries no personal identifier. | One year |
| ataa_attr | Cookie | Written only if you arrived from an advert carrying campaign labels (utm_source and similar). It stores the campaign name, the source and the landing page so we can tell which of our adverts worked. It never stores the click id (fbclid, gclid), so it cannot identify you, and it is never sent to any ad platform — it exists for our own report alone. Its contents are identical whether you consented or refused. | 90 days |
| ataa.session_token / ataa.session_data | Cookies (HttpOnly) | Your sign-in session on the newer stack (the admin console and what follows it). The first is the session token, the second a short copy of it that can be read without a database lookup on every request. Either may carry a __Secure- prefix on a secure connection. | Seven days for learners and teachers, 12 hours for admin accounts (the short copy, five minutes) |
| ataa_vh | Cookie | A single cosmetic flag saying this browser holds a session, so the header is drawn in the right state before the page first paints and you do not see “Sign in” replaced by your name a moment later. Readable by scripts on purpose, and it grants nothing by itself. | The lifetime of the access token (15 minutes) |
| ataa_did | Cookie (HttpOnly) | A random device identifier written when you sign in from a browser we have not seen before, so we recognise your device next time and can warn you about a sign-in from a new one. It carries neither your name nor your email, and is used for neither advertising nor analytics. It is long-lived because its whole job is to still be there at your next sign-in, which may be months away. | 400 days |
| ataa_mfa | Cookie (HttpOnly) | A short-lived hand-off ticket between the password screen and the two-step verification screen; it is deleted as soon as the step completes. | Five minutes (or less — the ticket's own expiry) |
| ataa_otp | Cookie (HttpOnly) | A short-lived hand-off ticket between asking for an email code and the screen where you type it, instead of carrying the reference in a link that stays in your history. | Five minutes (or less — the challenge's own expiry) |
| ataa_new_signup | Cookie | A marker saying this account was created just now, during checkout, so we can offer one prompt to complete your name after payment. It is removed as soon as you complete the name or dismiss the prompt. | One hour |
| ataa_guest / __Host-ataa_guest | Cookie (HttpOnly) | A short-lived pass that lets you complete a purchase and see its receipt without creating an account. It is scoped to the order it was issued for. | 30 minutes |
| ataa_session_rotate_at | Local storage | One timestamp that stops every open tab renewing your session at the same moment; written by whichever tab takes the renewal. | Until you clear it (rewritten on each renewal) |
| ataa.staleDocReload | Session storage | A marker written once if we had to reload a page left over from before a site update, so the reload cannot repeat. It dies with the tab. | The lifetime of the tab |
3.Preferences
These remember interface choices so you do not repeat them each visit, along with local copies and drafts of what you type yourself. Clearing them does not stop you using the platform, but it returns the settings to their defaults and deletes what you have not yet sent: your basket, your lesson notes and your draft instructor application.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| ataa_cur | Cookie | The display currency you picked in the currency switcher. Readable by scripts on purpose because it is a preference, not an authority. Your card is charged in the same currency you see; some payment methods — PayPal among them — cannot handle Gulf currencies and convert the order to US dollars, and the amount you will be charged is always shown before you pay. | One year |
| ataa_geo | Cookie | Your country code as the provider sees it when the request arrives, refreshed on each navigation. We use it to pick the currency shown to you before you choose one yourself. It carries neither your name nor your precise location. | One day |
| ataa_cart | Cookie | What is in your basket (course identifiers only), so you do not lose it if you close the tab or come back later. | 30 days |
| ataa_sidebar | Cookie | Remembers whether you collapsed the dashboard sidebar, so it is drawn in the right state from the first moment. It replaced the `ataa.sidebar.collapsed` local-storage key. | One year |
| ataa.theme | Local storage | Stores your light or dark theme choice, read before the page paints so there is no flash of the wrong theme. | Until you clear it |
| ataa.promo.v1 | Local storage | Remembers that you dismissed the promotional bar at the top of the site so it stays dismissed. | Until you clear it |
| ataa.cart.v1 | Local storage | A copy of the same basket inside the browser, used to show it immediately before the cookie is read. | Until you clear it |
| ataa.teacher.onboarding.v2 | Local storage | A draft of what you type into the instructor application, kept on your own device so it is not lost if you close the page before submitting. | Until you clear it or submit the application |
| ataa.notes.v1:<lesson id> | Local storage | The notes you write yourself during a lesson, with their timecode in the video, kept in this browser alone and never sent to the server. A separate key per lesson, and a lesson's key is removed automatically when you delete its last note. | Until you delete them or clear the site's data |
| ataa.complete-profile.dismissed.<your account id> | Local storage | Remembers that you dismissed the complete-your-profile prompt on your dashboard so it stays dismissed; its value is the moment you dismissed it. Your account id is part of the key name so the dismissal stays yours alone on a device more than one person signs in on. | Until you clear it |
4.Analytics — only with your consent
No usage measurement runs before you allow the “Analytics” category in the privacy panel. The one exception is basic page-performance measurement, which runs for every visitor and writes neither a cookie nor anything else to your browser — which is why it has no row in the tables here — and is described in the privacy policy. On acceptance we load Google Analytics 4 and run it in Consent Mode v2: before your choice, every Google storage and advertising signal is set to “denied”, and only your own choice changes that. We also ask Google to redact advertising identifiers from anything the browser does send.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| _ga | Cookie (written by Google) | A random visitor identifier that distinguishes the device between visits, so visitors are counted rather than page opens. It carries no name and no address. | Two years (set by Google) |
| _ga_XXXXXXXXXX | Cookie (written by Google) | Session state for this measurement property: when a session started and how many there have been, which is what makes the path through the site readable. | Two years (set by Google) |
5.Marketing — only with your consent
No advertising pixel loads and no marketing cookie is written before your consent. On your first visit with no recorded choice, a panel at the bottom of the storefront offers two buttons of equal shape and size — “Accept all” and “Reject all” — plus “Customise”, which separates the “Analytics” and “Advertising” categories so you can allow one and refuse the other. A refusal is stored in `ataa_consent` exactly the way acceptance is, and limits nothing about using the platform.
On acceptance, the Meta (Facebook and Instagram) and Snapchat tools load immediately in the same tab, and each writes a browser identifier onto our domain. These are used to measure advertising campaigns and to match visits and purchases to the ad that brought you. They are technically first-party cookies but their values are shared with the respective provider.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| _fbp | Cookie (written by Meta) | Meta's browser identifier, used to measure Facebook and Instagram campaigns and attribute conversions to them. | About 90 days (set by Meta) |
| _fbc | Cookie (written by Meta) | The click identifier when you arrive from an ad carrying the fbclid token, so a purchase is credited to that click. | About 90 days (set by Meta) |
| _scid | Cookie (written by Snap) | Snapchat's browser identifier, used to measure its campaigns and attribute conversions to them. | About 13 months (set by Snap) |
| ataa_px_purchase | Local storage (written by us) | A short list of the most recent purchase references already reported to the ad platforms, so a purchase is not counted twice if you return to the receipt page. It is written only after your consent and only once the event has actually been sent, and holds nothing but the order reference already in your own address bar. | Until you clear it (oldest entries drop off) |
6.Embedded third-party services
The player loads video from a content delivery network over short-lived signed URLs. That network may set a technical cookie to manage streaming quality and prevent link reuse. It is purely functional, lives no longer than the session, and is not used to build an advertising profile.
The payment page is hosted entirely by the payment service provider on their own domain; any cookie they set is governed by their policy, shown during checkout.
7.How to control them
- From your browser settings you can delete ataa.ai cookies and local storage at any time, or block the site from writing them at all.
- To change your decision at any moment: press “Privacy settings” in the footer. The panel opens on your current choice and any category can be switched off — withdrawing is as easy as granting was, and needs no cookie deleted by hand.
- Picking “Reject all” blocks any future pixel or analytics load, and deleting `_fbp`, `_fbc`, `_scid` and `_ga` removes what was previously written. Deleting `ataa_consent` itself makes the question return on your next visit.
- Deleting the two session cookies (`ataa_at` and `ataa_rt`) ends your session at once, and you will need to sign in again.
- Private browsing keeps none of these values after the window closes, so theme and currency return to their defaults each time.
8.Changes to this policy
The tables above are part of the product itself: any new value we write to your browser is added to the matching table in the same change. Check the “last updated” date at the top for the most recent revision.