Cookies
Last updated: 3 October 2026
What we use
Student Tracker uses only the cookies described below. We do not use advertising or third-party tracking cookies. We assessed the application and its dependencies to produce this list.
Cookies in use
| Cookie name | Purpose | Duration | Strictly necessary |
|---|---|---|---|
| next-auth.session-token (or __Secure-next-auth.session-token over HTTPS) | Session authentication when you log in; stores an encrypted session token so you stay signed in and we can identify your account and centre access. | Up to 7 days (session max age) | Yes – required to use the logged-in area of the service. |
| next-auth.csrf-token | Secrets used for protection during the sign-in flow. Used to validate login and callback requests. | Session (or short-lived) | Yes – required for secure authentication. |
| __Host-next-auth.callback-url | Stores the URL to return to after sign-in (e.g. after email verification). Used only during the auth flow. | Session or short-lived | Yes – required for correct redirects during login. |
The exact cookie names can vary by environment (e.g. __Secure- or __Host- prefixes when the site is served over HTTPS). All of the above are set by our own application (NextAuth.js) and are not shared with third parties for advertising or tracking.
What we do not use
- Analytics or tracking cookies (e.g. Google Analytics) – we do not currently use them.
- Advertising or marketing cookies.
- Third-party social or embedded content that sets its own cookies (we do not embed such content in a way that sets cookies).
Your choices
Because we use only strictly necessary cookies for authentication and security, we do not offer a cookie-consent banner for these: they are essential to provide the service. If you do not accept cookies, you will not be able to log in or use the protected areas of Student Tracker; you can still view our public marketing and legal pages.
Changes
If we introduce new cookies (e.g. analytics or optional features), we will update this page and the “Last updated” date. We will seek consent where required by law for non-essential cookies.