Cookie Policy
Last updated October 2026 · Applies to spiritofmathcontest.com, the contest platform, the Practice Centre and the shop.
This page explains which cookies and similar technologies our sites use, what we collect with them, and how you can change your mind. It supplements the Spirit of Math Privacy Policy, which covers everything we do with personal information.
Change your choice at any time: . Withdrawing analytics consent also asks our server to strip the visitor id from every page view it recorded for that browser.
The short version
Nothing beyond the essentials is set until you choose — and the essentials include a few items the sites keep in your browser's own storage rather than in cookies, listed below under Browser storage. If you do nothing, only the essential ones are used and we count page views without any identifier. If you accept analytics, we set one cookie of our own with a random id, and on the contest website and platform PostHog, the analytics service we use, sets its own. If you accept marketing, HubSpot's script loads. We never sell personal information, and we do not store your IP address with page views.
Essential — always on
These are needed for the sites to work and need no consent.
| Name | What it does | Kept for |
|---|---|---|
| som_access, som_refresh | Keeps you signed in on the contest platform and the Practice Centre. | 1 hour / 30 days |
| som_csrf | Protects signed-in actions against forged requests. | 30 days |
| Stripe, Shopify | Set by our payment and shop providers during checkout only. | Session |
Browser storage — always on
Besides cookies, the sites keep a few things in your browser's own storage (localStorage and sessionStorage). Nothing here identifies you to us: no name, email, password or sign-in token is ever kept there — sign-in lives only in the HttpOnly cookies above — and none of it is sent to anyone but our own servers. You can clear it at any time from your browser's site-data settings.
| Name | What it does | Kept for |
|---|---|---|
| som.cookieConsent.v1 | The choice you made in the cookie banner, so we do not ask again. | 13 months |
| som.lang.v1 | The language you picked for the site. | Until you clear it |
| somc.shop.cartId | The id of your shop cart, so it is still there when you come back. It holds no product or payment details — those stay with Shopify. | Until you clear it |
| somc.practice.activeChild | On the Practice Centre: which of your children is practising right now (their first name, id and language), so lessons open as them. Cleared when you sign out. | Until you sign out |
| som.practiceRef.v1 | On the Practice Centre: the partner referral code from a link you arrived on, so a purchase credits that partner. | 90 days |
| som.langReady.v1 | On the Practice Centre: which languages are fully translated, so the language menu draws without a round trip. | Until you clear it |
| som.pendingSchool.v1 | On the registration platform: the school details you typed on the sign-up form, so they survive confirming your email in another tab. Removed once the school is set up. | Until the school is set up |
| Sidebar, tour and layout preferences | On the registration platform: whether you collapsed a sidebar, dismissed a welcome tour or chose a desk layout. No personal data. | Until you clear it |
| Session-only drafts (sessionStorage) | The student roster you are typing, a promo code you applied, the email you gave on a results page, a marketing form you started, the chat's message count. Gone when the tab closes. | The tab |
Analytics — Spirit of Math and PostHog, with your consent
Our own analytics runs on our own servers; no advertising network is involved. For each page view we record the page, the site, the time, the referring website's domain (never the full address) and any campaign tags in the link. Before you consent, that is all — there is no identifier, so two visits cannot be linked. After you consent, the visit also carries the random id below, and if you later sign in to the contest platform, or arrive from a link in an email we sent you, we may link that id to your account or email address so our team can see that you visited. We keep this for 13 months, then delete it automatically.
On the contest website and the contest platform, accepting analytics also turns on PostHog, the product-analytics service we use to see how pages are used and where people get stuck. PostHog records page views, clicks and, as recordings, how the page moves as you use it. On the contest website it receives only a random id for the browser, never your name or email. On the contest platform, once you sign in, PostHog is told which account you are — your account id, email and name, and the kind of account (family, school and so on) — so we can see your registration as one journey rather than a series of strangers; signing out ends that link on the browser. If you apply to become a Global Partner (Country Head) without an account, PostHog is told the email and name you put in the application, so our team can see the visits that led to it. When you click through to the application from the website, the website's random id is added to the link so those website visits are included; this happens only on that link and only if you have accepted analytics on the website. The email is never used as your PostHog id. Everything you type is hidden from recordings; on the contest platform, where family and results pages show children's names and scores, all page text is hidden too, and pages opened from a private link (a survey, unsubscribe or invitation link) are not recorded at all. Private codes in links, query strings and database ids are removed before anything is sent, and PostHog discards your IP address after working out the country. If you buy from the shop, the order's value and the products in it are recorded against that same random id, so we can see which pages lead to purchases — never your name, email, address or order number. If a page breaks, PostHog also receives an error report (what went wrong, where in our code, which page and browser) with any email address or phone number removed. PostHog is never loaded on the Practice Centre.
Past contest papers open in a page-by-page reader on this site. So we can see which papers are useful, our own server records how far each opening got and for how long — anonymously, unless you accepted analytics and we already know you (you signed in, or came from one of our emails), or you opened a link we sent you personally. With analytics accepted, PostHog also receives those reading steps.
On the Practice Centre PostHog runs only on the parent pages: the course list, a course's overview, plans, sign-in, checkout and the family page. There, with your consent, it records page views and a recording of how the page moves as you use it, with everything you type and all page text hidden; our server also tells it when your browser reaches a step towards a family plan (signing up, adding a learner — the fact only — choosing a plan, subscribing). All of it is under a scrambled id that is not your name or email. On a lesson, quiz, activity, contest or a child's own pages the recording is stopped and nothing is sent, so nothing about your children or their learning ever reaches PostHog. Recordings made by our own staff while testing the site may show the text on the page; a family's never does.
| Name | What it does | Kept for |
|---|---|---|
| som_vid | A random id (32 characters) so we can tell that two visits came from the same browser. It is not your name or email, and it is created only after you accept analytics. | 13 months |
| ph_phc_…_posthog (cookie and browser storage) | PostHog's id for this browser and the current visit, so page views and recordings from one visit belong together. It is created only after you accept analytics. On the website it is a random id, never your name or email (if you follow a link from the website to the partner application, that id goes with you so both visits count as one); on the contest platform it becomes your account id once you sign in (see below) and is reset when you sign out; on the Practice Centre it is a scrambled id that is not your name or email. | Up to 1 year (set by PostHog); recordings are deleted after 30 days |
Marketing — HubSpot, with your consent
HubSpot is the customer-relationship system we use for marketing. If you allow marketing cookies, its tracking script records your visits and may connect them to a contact record if you have given us your email address. HubSpot's own policy describes its cookies in detail. HubSpot is never loaded on the Practice Centre, which is used by families with children: there, only our own analytics cookie is offered (see above for the plan steps its server reports).
| Name | What it does | Kept for |
|---|---|---|
| __hstc, hubspotutk, __hssc, __hssrc | HubSpot's visitor tracking, used to measure our marketing campaigns. Loads only if you allow marketing cookies. | Up to 13 months (set by HubSpot) |
Legal basis
Essential cookies are used on the basis of our legitimate interest in running a working, secure site. Analytics and marketing cookies are set only with your consent (GDPR Article 6(1)(a) and the ePrivacy rules; PIPEDA and CASL in Canada). Page counts with no identifier rely on our legitimate interest in understanding how the sites are used; they cannot identify anyone.
Who processes this data
Our sites are hosted by Vercel, our backend by Railway, and our database by Supabase; these providers store the data on our behalf and do not use it for their own purposes. PostHog (hosted in the United States) processes analytics data only when you allow analytics cookies, and HubSpot processes marketing data only when you allow marketing cookies. Some of these providers operate outside Canada and the EU; transfers are covered by their standard data-processing terms.
Your rights
You can withdraw consent at any time with the Cookie settings button above. You can also ask us for a copy of the browsing data we hold against your email address, or ask us to erase it, by writing to [email protected]. If you are in the EU or UK you may also complain to your data-protection authority.
Who we are
Spirit of Math Schools Inc., Toronto, Canada, is the data controller for these sites.