Cookies & Tracking

All of StudySocial’s cookies are first-party, and your browser sends each of them to StudySocial’s server with every request to the site. Sign-in and invite cookies are httpOnly, which means scripts in the page can’t read them. The optional setup-draft cookie can be read by scripts so it can carry your own choices through signing in; the server doesn’t read it. Each exists for a single job.

studysocial_session

What it does

Keeps you signed in. It holds a random token that matches a session record in our database.

How long

30 days.

Removed when

You sign out (the session is deleted on the server too), you change your password (every session is signed out), or the 30 days pass.

ss_google_oauth

What it does

Holds an in-progress “Continue with Google” sign-in so we can check that the reply from Google belongs to your request.

How long

10 minutes.

Removed when

The sign-in finishes or the 10 minutes pass. It is only set if you start a Google sign-in, and only when the deployment offers one.

ss_brightspace_oauth

What it does

Holds an in-progress school sign-in when you connect Brightspace with full sync, for the same reason.

How long

10 minutes.

Removed when

The connection finishes or the 10 minutes pass. It is only set if you start a school sign-in.

ss_ref

What it does

Remembers the public invite code from a friend’s link you opened, so that if you sign up the invite can be credited to them. It holds only the code — nothing about you.

How long

7 days.

Removed when

You sign up or sign in, or the 7 days pass. It is only set if you open someone’s invite link.

Besides cookies, StudySocial keeps small values in localStorage. The optional studysocial_week_draft_v1 and ss_week_draft cookie hold selected priorities, progress, optional school and program names, an optional study date/time/duration and an expiry identifier. The ss_week_draft cookie expires after 7 days. The studysocial_week_draft_v1 browser entry is accepted for 7 days from when you started it and is cleared when your setup is saved or you reset it; if you never come back, it stays in your browser until you clear site data, and StudySocial ignores it. After authentication, the chosen setup is sent to StudySocial to save it privately to that account; a private editable calendar commitment is created only if chosen. School and program entries do not verify enrollment or change discoverability or sharing permissions. These drafts are not synced across devices and contain no credentials, contacts or imported timetable. Other local values below are device preferences, not sent to our server:

• ss.theme remembers whether you chose Light, Dark or System appearance on this device.
• studysocial.nav.collapsed remembers whether you collapsed the sidebar.
• ss.whosfree.with remembers which friends you last picked in Who’s free on Today, so it opens on the same people. It holds their account IDs and yours, not names or schedules, so it is only ever shown back to you.
• ss.focus.timer remembers a running focus timer so it survives a page reload: what you are working on, its class, and your account ID, so it is only ever shown back to you.
• ss.focus.pos remembers where on the screen you dragged that timer.
• ss.brightspace.host and ss.school.host.… remember your school’s web address so you do not retype it when connecting.
• ss.class.part.… remembers which parts of a class you collapsed, one value per part.
• ss.ping.usual remembers the weekly times you saved as “usual” when pinging someone: a weekday, a start and end time, grouped by the account IDs of the friends in that ping, not names or schedules. It’s stored with your account ID, is only ever shown back to you, and isn’t sent to our server until you use one of those times in a ping.

The timer, the Who’s free pick and your saved Ping usual times belong to the account that saved them. If someone else signs in on the same browser, they never see yours: it is deleted instead. Signing out or deleting your account also deletes them, along with the school address and which class parts you collapsed. The preview on the home page and at /explore keeps its examples in memory and never reads or writes these.

That is all of it. Nothing else is kept in your browser.

• No analytics of any kind.
• No advertising cookies or ad networks.
• No tracking pixels.
• No third-party cookies.
• No browser fingerprinting.
• No error-monitoring or crash-reporting SDKs.

Fonts are bundled with the app when it is built, so opening a page does not call Google Fonts or any other font service.

The app is hosted on Vercel. Like any web host, Vercel keeps standard request logs for operations: your IP address, browser (user agent), the URL requested, and timing. These logs live outside StudySocial’s database and follow Vercel’s own retention. StudySocial does not add anything to them.

Your browser only contacts another service in the situations below, each of which you start yourself. Syncing your school is not one of them: those requests are made by StudySocial’s server, not by your browser.

• jsDelivr CDN, when you import a schedule from an image. Your browser downloads the text-recognition engine and English language data from cdn.jsdelivr.net. The image itself is processed on your device and never uploaded.
• Google, when you choose Google sign-in (only offered when the deployment has it configured).
• Supabase Storage, when you add course files to a class. The files go from your browser straight to StudySocial’s private file store using a short-lived link, so they never pass through anything else. This is only available when the deployment has file storage configured.

• Sign out to delete your session cookie and the matching session on the server, and the values above that belong to your account.
• Clear site data in your browser’s settings to remove every cookie and every localStorage value listed above.
• Block cookies if you like, but StudySocial cannot keep you signed in without the session cookie, so you would need to sign in on every visit and some pages will not work.

How cookies fit into everything else we store is covered in the Privacy Policy.