Cookie Policy
Last updated October 2026 · Applies to spiritofmathcontest.com, the contest platform, the Practice Centre and the shop.
This page explains which cookies and similar technologies our sites use, what we collect with them, and how you can change your mind. It supplements the Spirit of Math Privacy Policy, which covers everything we do with personal information.
Change your choice at any time: . Withdrawing analytics consent also asks our server to strip the visitor id from every page view it recorded for that browser.
The short version
Nothing beyond the essentials is set until you choose — and the essentials include a few items the sites keep in your browser's own storage rather than in cookies, listed below under Browser storage. If you do nothing, only the essential ones are used and we count page views without any identifier. If you accept analytics, we set one cookie of our own with a random id, and on the contest website and platform PostHog, the analytics service we use, sets its own. If you accept marketing, the Google tag (for Google Ads) loads and, when configured on the contest website, OpenAI Ads loads. We never sell personal information, and we do not store your IP address with page views.
Essential — always on
These are needed for the sites to work and need no consent.
| Name | What it does | Kept for |
|---|---|---|
| som_access, som_refresh | Keeps you signed in on the contest platform and the Practice Centre. | 1 hour / 30 days |
| som_csrf | Protects signed-in actions against forged requests. | 30 days |
| Stripe, Shopify | Set by our payment and shop providers during checkout only. | Session |
Browser storage — always on
Besides cookies, the sites keep a few things in your browser's own storage (localStorage and sessionStorage). Nothing here identifies you to us: no name, email, password or sign-in token is ever kept there — sign-in lives only in the HttpOnly cookies above — and none of it is sent to anyone but our own servers. You can clear it at any time from your browser's site-data settings.
| Name | What it does | Kept for |
|---|---|---|
| som.cookieConsent.v1 | The choice you made in the cookie banner, so we do not ask again. | 13 months |
| som.lang.v1 | The language you picked for the site. | Until you clear it |
| somc.shop.cartId | The id of your shop cart, so it is still there when you come back. It holds no product or payment details — those stay with Shopify. | Until you clear it |
| somc.practice.activeChild | On the Practice Centre: which of your children is practising right now (their first name, id and language), so lessons open as them. Cleared when you sign out. | Until you sign out |
| som.practiceRef.v1 | On the Practice Centre: the partner referral code from a link you arrived on, so a purchase credits that partner. | 90 days |
| som.langReady.v1 | On the Practice Centre: which languages are fully translated, so the language menu draws without a round trip. | Until you clear it |
| som.pendingSchool.v1 | On the registration platform: the school details you typed on the sign-up form, so they survive confirming your email in another tab. Removed once the school is set up. | Until the school is set up |
| Sidebar, tour and layout preferences | On the registration platform: whether you collapsed a sidebar, dismissed a welcome tour or chose a desk layout. No personal data. | Until you clear it |
| Session-only drafts (sessionStorage) | The student roster you are typing, a promo code you applied, the email you gave on a results page, a marketing form you started, the chat's message count. Gone when the tab closes. | The tab |
Analytics — Spirit of Math and PostHog, with your consent
Our own analytics runs on our own servers; no advertising network is involved. For each page view we record the page, the site, the time, the referring website's domain (never the full address) and any campaign tags in the link. Before you consent, that is all — there is no identifier, so two visits cannot be linked. If you arrived from one of our ads or campaign links, its campaign tags (never anything about you) are added to the links that take you on to the contest platform, so that site knows the campaign too. After you consent, the visit also carries the random id below, and if you later sign in to the contest platform, or arrive from a link in an email we sent you, we may link that id to your account or email address so our team can see that you visited. We keep this for 13 months, then delete it automatically.
On the contest website and the contest platform, accepting analytics also turns on PostHog, the product-analytics service we use to see how pages are used and where people get stuck. PostHog records page views, clicks and, as recordings, how the page moves as you use it. On the contest website it receives only a random id for the browser, never your name or email. On the contest platform, once you sign in, PostHog is told which account you are — your account id, email and name, and the kind of account (family, school and so on) — so we can see your registration as one journey rather than a series of strangers; signing out ends that link on the browser. If you apply to become a Global Partner (Country Head) without an account, PostHog is told the email and name you put in the application, so our team can see the visits that led to it. When you click through to the application from the website, the website's random id is added to the link so those website visits are included; this happens only on that link and only if you have accepted analytics on the website. The email is never used as your PostHog id. Everything you type is hidden from recordings; on the contest platform, where family and results pages show children's names and scores, all page text is hidden too, and pages opened from a private link (a survey, unsubscribe or invitation link) are not recorded at all. Private codes in links, query strings and database ids are removed before anything is sent, and PostHog discards your IP address after working out the country. If you buy from the shop, the order's value and the products in it are recorded against that same random id, so we can see which pages lead to purchases — never your name, email, address or order number. If a page breaks, PostHog also receives an error report (what went wrong, where in our code, which page and browser) with any email address or phone number removed. PostHog is never loaded on the Practice Centre.
Page speed. With the same analytics consent, on all three sites (the website, the contest platform and the Practice Centre), how fast each page loaded on your device — the time until it painted, until it responded to a tap, and how much it shifted while loading — is sent to Vercel, the company that hosts our sites, so we can find slow pages and fix them. It is sent under the page's route (for example "/admin/schools/[id]"), with private codes and ids removed; it sets no cookie and carries no name, email or account, only the timings and the kind of device and connection.
Past contest papers open in a page-by-page reader on this site. So we can see which papers are useful, our own server records how far each opening got and for how long — anonymously, unless you accepted analytics and we already know you (you signed in, or came from one of our emails), or you opened a link we sent you personally. With analytics accepted, PostHog also receives those reading steps.
On the Practice Centre PostHog runs only on the parent pages: the course list, a course's overview, plans, sign-in, checkout and the family page. There, with your consent, it records page views and a recording of how the page moves as you use it, with everything you type and all page text hidden; our server also tells it when your browser reaches a step towards a family plan (signing up, adding a learner — the fact only — choosing a plan, subscribing). All of it is under a scrambled id that is not your name or email. On a lesson, quiz, activity, contest or a child's own pages the recording is stopped and nothing is sent, so nothing about your children or their learning ever reaches PostHog. Recordings made by our own staff while testing the site may show the text on the page; a family's never does.
| Name | What it does | Kept for |
|---|---|---|
| som_vid | A random id (32 characters) so we can tell that two visits came from the same browser. It is not your name or email, and it is created only after you accept analytics. | 13 months |
| som.landingCampaign.v1 (sessionStorage) | The campaign tags of the link you arrived on (for example utm_campaign=2027-schools from one of our ads) and, only if you also allow marketing cookies, the ad's click id — kept for this visit so that a registration you pay for on the contest platform is credited to the campaign that brought you. Never your name or email. Created only after you accept analytics, deleted if you withdraw, and sent with your payment only while analytics is allowed. | The tab |
| ph_phc_…_posthog (cookie and browser storage) | PostHog's id for this browser and the current visit, so page views and recordings from one visit belong together. It is created only after you accept analytics. On the website it is a random id, never your name or email (if you follow a link from the website to the partner application, that id goes with you so both visits count as one); on the contest platform it becomes your account id once you sign in (see below) and is reset when you sign out; on the Practice Centre it is a scrambled id that is not your name or email. | Up to 1 year (set by PostHog); recordings are deleted after 30 days |
Marketing — Google Ads and OpenAI Ads, with your consent
On the Practice Centre, Marketing is a separate optional choice for measuring free account signups and the first confirmed payment for a subscription through OpenAI Ads. No advertising script runs there, and no children's details or learning activity are sent. With Marketing allowed, an advertising reference from a parent-facing landing page may be stored in the first-party __oppref cookie for up to 30 days. Our server sends only the conversion fact, plan, any payment value and currency, a generic sign-in or checkout address and that reference. Account names, emails and account identifiers are excluded. Withdrawing Marketing clears that cookie and stops new conversion context; a checkout already started retains its consent snapshot for up to 30 days. Renewals are not new subscription conversions. The free plan is ongoing limited access, not a time-limited trial.
OpenAI Ads (contest website and paid school registrations). If configured and you accept Marketing, OpenAI receives public page views, accepted contact and school quote conversions, and confirmed paid shop purchases. With Marketing consent, the cart carries your consent choice and advertising reference to Shopify so our server can report the purchase value, currency and product identifiers. It does not send your name, email, phone or address. Its browser SDK uses the first-party __oppref attribution and __obref browser-reference cookies; our server also sends the conversion with the same random event id, attribution and page origin/path, so it can be counted once. We send no names, emails or account ids. Withdrawing Marketing stops reporting through the SDK consent control and clears both cookies. No OpenAI advertising tag runs on the Practice Centre or registration platform. With a separate Marketing choice on the registration platform, the server reports a school registration after its first payment is confirmed. The payment carries that choice and any available advertising reference for up to 30 days, using only the payment page’s origin and generic path. Global Round family registrations are excluded. This sends no names, emails, student details or account identifiers. A checkout already in progress keeps the choice made when it started.
Google Ads. We advertise on Google. If you allow marketing cookies, the website and the contest platform load the Google tag (gtag.js), which remembers that you arrived from one of our Google ads and tells Google Ads when the visit led somewhere: a National Round registration paid on the contest platform (with the amount, the currency and the registration's reference so it is counted once), a school registered on the contest platform (with the school's reference), a school nominated on this website, a partnership enquiry sent from the contact page, or a click through to the Practice Centre (only the click — nothing is measured on the Practice Centre itself). Each of these is just “it happened”: nothing you typed is sent. It never receives your name, email, phone number or your children's details, and the page addresses it receives have private codes and ids removed. Google uses this to report how our ads perform and, with the same consent, may add your browser to an audience of our site's visitors. Google Analytics is not used. Google's own policy (policies.google.com/technologies/ads) describes these cookies. Google Ads is never loaded on the Practice Centre. Withdrawing marketing consent stops the tag and deletes its cookies.
| Name | What it does | Kept for |
|---|---|---|
| __obref | OpenAI Ads random browser reference on the contest website, only after Marketing consent. Cleared on withdrawal. | 365 days; cleared when you withdraw |
| __oppref | OpenAI Ads attribution context on the contest website, only after Marketing consent. Cleared on withdrawal. | 30 days; cleared when you withdraw |
| _gcl_au, _gcl_aw (and _gcl_gb, _gcl_dc) | Google Ads' conversion linker, set by the Google tag (provider: Google). _gcl_au is a random id for this browser; _gcl_aw (and its variants) remembers the click id when you arrive from one of our Google ads, so that a registration, school sign-up, nomination or enquiry that follows can be credited to that ad. Shared across our spiritofmathcontest.com sites. Loads only if you allow marketing cookies, and is deleted if you withdraw. | 90 days (set by Google) |
Legal basis
Essential cookies are used on the basis of our legitimate interest in running a working, secure site. Analytics and marketing cookies are set only with your consent (GDPR Article 6(1)(a) and the ePrivacy rules; PIPEDA and CASL in Canada). Page counts with no identifier rely on our legitimate interest in understanding how the sites are used; they cannot identify anyone.
Who processes this data
Our sites are hosted by Vercel, our backend by Railway, and our database by Supabase; these providers store the data on our behalf and do not use it for their own purposes. PostHog (hosted in the United States) processes analytics data only when you allow analytics cookies, and Google (Google Ads) processes marketing data only when you allow marketing cookies. Some of these providers operate outside Canada and the EU; transfers are covered by their standard data-processing terms.
Your rights
You can withdraw consent at any time with the Cookie settings button above. You can also ask us for a copy of the browsing data we hold against your email address, or ask us to erase it, by writing to [email protected]. If you are in the EU or UK you may also complain to your data-protection authority.
Who we are
Spirit of Math Schools Inc., Toronto, Canada, is the data controller for these sites.