COOKIE POLICY
Last updated: March 13, 2026
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, work more efficiently, and to provide information to site owners. We also use localStorage — a similar browser feature that stores data locally on your device but is never transmitted to our servers automatically.
Henley Education uses cookies and localStorage for:
We do not use advertising, behavioural tracking, or profiling cookies of any kind.
These cookies are strictly necessary for the platform to function. The site cannot work without them.
| Cookie / Storage Item | Purpose | Duration | Type |
|---|---|---|---|
henley_session |
Keeps you logged in during your visit. Stores your user ID and role server-side. | 24 hours | Essential |
| CSRF token (meta tag) | Prevents cross-site request forgery attacks on form submissions and API calls. | Per session | Essential |
| Parent session token | Separate secure token for the parent portal, stored server-side and validated on every request. | Per session | Essential |
cookies_functional (localStorage) |
Stores your functional cookie preference so the consent banner is not shown on every visit. | Until cleared | Essential |
These items are stored in your browser's localStorage, not transmitted as cookies. They improve your experience but are not required for the platform to work. You can disable them below or via your data settings page.
| Storage Key | Purpose | Duration | Type |
|---|---|---|---|
theme |
Remembers whether you chose dark or light mode. | Until cleared | Functional |
| Practice session keys (timer start, timer total, seen question IDs, seen date) |
Preserves your in-progress practice session timer and seen questions across page refreshes. Prevents losing your place if the page is accidentally reloaded. | Until practice session ends or cleared | Functional |
The following third parties may set cookies or log network requests when you use certain parts of the platform:
| Service | When Active | Purpose | Type |
|---|---|---|---|
Stripe JS (js.stripe.com/v3/) |
Checkout/payment page only | Fraud prevention, payment session management. Stripe sets its own cookies governed by their privacy policy. | Third-Party |
Stripe is PCI-DSS compliant. See Stripe's Privacy Policy for details of cookies they set.
The platform loads fonts and UI assets from external CDNs. These CDNs may log your IP address in their access logs but do not set tracking cookies:
No consent is required for CDN asset loading under most GDPR interpretations, but we disclose it here for full transparency.
You can also manage preferences from your data settings page at any time.
You can block or delete cookies through your browser settings. Note that blocking essential cookies will prevent you from logging in:
Our platform is used by secondary school students, some of whom may be under the age of 13. We take the ICO's Age Appropriate Design Code (Children's Code) seriously:
We may update this policy to reflect changes in technology, legislation, or our services. We will update the "Last updated" date at the top of this page when changes are made.
Email: privacy@henleyed.co.uk
Response time: Within 5 working days
Subject line: "Cookie Policy Enquiry"
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.