Cookie and Local Storage Statement
| Version | v1.0 draft |
| Date | 3 October 2026 |
| Status | Draft for counsel's review, not yet in force |
| Controller | Schweizer Bildungsglobus AG (Swiss eduGLOBE AG), c/o Benediktiner Kloster Disentis, Via Claustra 1, 7180 Disentis/Mustér, Switzerland, UID CHE-219.746.858 (correspondence: Leimbachstrasse 153, 8041 Zürich) |
| Applies to | euler.swiss and stella.academy |
1. Why this statement exists
Swiss law (Art. 45c of the Telecommunications Act) allows a website to store data on your device, such as cookies or local storage, only if you are told what is stored and why, and that you may refuse it. This statement gives that information for euler.swiss and stella.academy. It is linked from the footer of every page and from both Privacy Notices.
2. Why no cookie banner is shown
We set only cookies and storage that are technically necessary to provide the Platform you asked for and to keep it secure. We use no analytics, no advertising technology, no tracking pixels, no social-media buttons and no third-party scripts. Fonts are served from our own servers. The Federal Data Protection and Information Commissioner's guidance on cookies (version 1.1, 6 October 2025) requires a banner only where non-essential cookies are set. None are, so there is no banner. If that ever changes, this statement will change first and a consent control will be added.
3. What we store on your device
All items below are set by us (first party). None is read by anyone else.
| Name | Type | Purpose | Contains | Lifetime |
|---|---|---|---|---|
[PLACEHOLDER: session cookie name, e.g. e100_session] | Cookie, HttpOnly, Secure, SameSite=Lax | Keeps you or your child logged in. The cookie holds only a random identifier; the session itself is stored on our server | Random identifier | Until logout or [PLACEHOLDER: session length, e.g. 12 hours] of inactivity; a child session is shorter: [PLACEHOLDER] |
[PLACEHOLDER: CSRF cookie name, e.g. e100_csrf] | Cookie, Secure, SameSite=Lax | Protects every form that changes something (a consent, a PIN, a deletion) against cross-site request forgery | Random token | Session |
[PLACEHOLDER: language cookie name, e.g. e100_lang] | Cookie | Remembers the language you chose (English, German, French or Italian) when you switch from the language suggested by your browser | A language code such as de | 12 months |
[PLACEHOLDER: local storage key, e.g. e100_adventure] | Local storage | Keeps the child's adventure in progress (which of the ten problems is current, answers entered so far) so that a page reload or a dropped connection does not lose the adventure | Problem positions and entered answers; no name, no Euler ID | Cleared when the adventure is submitted or after 24 hours |
[PLACEHOLDER: rate-limit or anti-abuse cookie, if any] | Cookie | Brute-force protection on the login and PIN screens | Counter | [PLACEHOLDER] |
[PLACEHOLDER: the exact names, lifetimes and any additional keys must be taken from the Beta 0.2 build before publication. Nothing may be added to this table without a review against section 2.]
The Federal Data Protection and Information Commissioner recommends that necessary cookies avoid identifiers where a non-identifying value suffices. Our language cookie and local-storage key contain no identifier. The session and CSRF cookies contain random values that identify a session, not a person; the person is known only on our server.
4. What we do not store or use
- No analytics or statistics service of any kind.
- No advertising or marketing cookies.
- No third-party cookies, embedded players or fonts loaded from other companies. One third-party script: the Cloudflare Turnstile human check on the public forms (registration, contact, feedback, the school door, the Faculty sign-up, the password-reset request, the waiting list), which sets no cookie on our sites and never appears on a child's screen or on a form you fill while logged in [PLACEHOLDER: counsel to confirm; SEC-CAPTCHA, 20 October 2026].
- No fingerprinting of your device.
- No cookie set on a child's screen that is not in the table above.
5. How to refuse
You can refuse or delete cookies and local storage in your browser's settings. Every current browser lets you block cookies for a specific site, block all cookies, or delete stored data. The help pages of your browser explain how.
The consequence. The session and CSRF cookies are needed to log in. If you block them, you and your child will not be able to log in to euler.swiss or stella.academy. Blocking the language cookie means the site will show your browser's language on each visit. Blocking local storage means an adventure in progress is lost if the page reloads.
6. Public pages without login
Pages that can be read without logging in, such as the home page, the public leaderboards and these notices, set only the language cookie if you choose a language. No other data is stored on your device until you log in.
7. Staging and testing sites
Our testing sites at beta.euler.swiss and beta.stella.academy are password protected and are not open to the public. They store the same items as above and nothing more. [PLACEHOLDER: remove this section if the staging sites are not publicly reachable at launch.]
8. Changes
We update this statement before any change to what we store on your device. The version and date at the top tell you which version you are reading. Previous versions are available on request at privacy@euler.swiss.
9. Related documents
Privacy Notice for Parents · Privacy Notice for Children · Terms of Use for Parents · Impressum.
From the build: what Beta 0.2 stores on your device today
This table is generated from the code that sets the cookies, so it cannot drift from the build. No local storage key is used yet: an adventure in progress is kept on the server, not in the browser. No language cookie is set yet (the interface is in English). Nothing else is stored.
| Name | Type | Purpose | Contains | Lifetime |
|---|---|---|---|---|
e100s | Cookie, HttpOnly, Secure (on https), SameSite=Lax | Keeps a parent, a Faculty member or a candidate logged in. The cookie holds a random identifier; only a hash of it is stored on our server, with the session | Random identifier | Parent and Faculty: 14 days, ending after 24 hours without activity. Candidate: 4 hours, ending after 90 minutes without activity. Deleted at logout |
e100c | Cookie, HttpOnly, Secure (on https), SameSite=Lax, signed | Protects the forms a visitor fills before logging in (registration, both log-in doors) against cross-site request forgery. After login the token lives in the server session instead | Random token | 2 hours |
e100a | Cookie, HttpOnly, Secure (on https), SameSite=Lax | Remembers which of a parent's candidates the Profile page last showed | The candidate's Euler ID | 14 days |
Related: Impressum · Privacy Notice for Parents and Legal Guardians · Privacy Notice for Children · Terms of Use for Parents and Legal Guardians · Sub-processor List and Records of Processing · Faculty Terms (outline) · Paid Plans and Refund Policy (outline). Questions: privacy@euler.swiss.