Cookie Policy
Last updated: September 9, 2026
Yanga Med QBank uses only the cookies needed to sign you in and keep you safe, plus your browser's local storage for preferences. We set no advertising, social-media, or cross-site tracking cookies, and we do not load third-party widgets or embeds. Because nothing here is optional tracking, no cookie-consent banner is required, and we do not show one.
1. Cookies we set
| Cookie | Purpose | Type |
|---|---|---|
| authjs.session-token (Secure- prefixed on HTTPS) | Keeps you signed in. Expires after 24 hours of inactivity. | Strictly necessary |
| authjs.csrf-token | Protects sign-in forms from cross-site request forgery. | Strictly necessary |
| authjs.callback-url | Returns you to the page you were on after signing in. | Strictly necessary |
These cookies are first-party, HttpOnly where the browser allows, and sent only over HTTPS.
2. Local storage on your device
These values never leave your browser and are not cookies. Clearing site data in your browser removes them.
| Key | Purpose |
|---|---|
| theme | Light, dark, or sepia theme choice. |
| Text zoom and image contrast | Display settings for readability. |
| highlighter-color | Your last highlighter pen colour on question stems. |
| pageHelpSeen:<user> | Which page-help pop-ups you have already seen. |
| pricing-notice / community-seen / focus-mode | Whether you dismissed a notice, which community items you have seen, and dashboard focus mode. |
| reportedTimezone:<user> | The time zone last sent to the server so streaks count days correctly. |
| quiz progress:<quiz> | Answers in an in-progress quiz so a refresh does not lose them. |
| IndexedDB: chat store | Your direct-message history and encryption keys, stored only on this device. |
| Service-worker cache | Copies of recently viewed app pages and API responses so the app opens offline. |
3. Analytics and error monitoring (no cookies)
- Vercel Web Analytics counts page views and referrers. It sets no cookie and stores no persistent identifier; visitors are distinguished by a hash of the request that is discarded after 24 hours, so you cannot be tracked across days or across sites.
- Vercel Speed Insights reports page-load timings so we can fix slow pages. No cookies, no personal identifiers.
- Sentry receives error reports with browser and device details. Only when an error occurs, it records a replay of the affected screen with all text masked and all images blocked. No cookies are set.
You can object to error monitoring or analytics at any time by emailing kalangedavies@gmail.com; blocking the domains vitals.vercel-insights.com and *.sentry.io in your browser also disables them without breaking the app.
4. Managing cookies
You can delete or block cookies in your browser settings. Blocking the strictly necessary cookies will sign you out and prevent sign-in. Because we set no optional cookies, there is nothing further to opt out of.
5. Changes
If we ever introduce an optional cookie or tracker, we will update this policy first and ask for your consent before setting it. See also our Privacy Policy.