The public pages store nothing
The assessment page, its privacy and legal pages, and the Passport verification page set no cookies and write nothing to your browser's local storage, session storage or any other on-device store. There is no analytics, no advertising technology, no session replay, no tracking pixel and no social-media embed. We measured this on 12 October 2026 across every public page at desktop, tablet and phone sizes; the method and the result are published in our evidence record.
Because nothing is stored on or read from your device by those pages, the rules on storage and access technologies (regulation 6 of the Privacy and Electronic Communications Regulations 2003 and its Schedule A1) require neither your consent nor a banner, and we do not show one.
The signed-in register sets two strictly necessary cookies
When someone signs in to the AI tools register (the signed-in part of the service, for schools and trusts that have been set up on it), the cookies below are set. Both are needed to provide the pages you asked for; neither tracks you, and neither is read by anyone but our own service. Consent is therefore not required for them, and no banner is shown. This part of the service is used only by organisations that have been set up on it.
| Name | What it is for | How long it lasts | Strictly necessary? |
|---|---|---|---|
edu_session | Keeps you signed in: a signed token naming your account and when it expires. HttpOnly (no script can read it), sent only to our own site, and only over HTTPS in production. | 12 hours from sign-in, or until you sign out | Yes — without it every page would ask you to sign in again |
edu_pkce | Protects the sign-in itself: a one-time value set when you ask for a sign-in link and checked when you return with it, so that a link cannot be used from another browser. | 15 minutes, and removed as soon as sign-in completes | Yes — it is part of the sign-in |
The register sets no other cookie and writes nothing to local or session storage. Signing out removes edu_session.
What the pages load from elsewhere
| Resource | Provider | What the provider receives | Why |
|---|---|---|---|
| Typefaces (Cormorant Garamond, DM Sans) on the Passport verification page | Google Fonts (fonts.googleapis.com, fonts.gstatic.com) | your IP address and browser details for the font request; Google sets no cookie on our pages | the verification page's typography. The assessment page, the register and the legal pages use your device's own fonts and make no such request. |
| Passport data on the verification page | Supabase (our database, Ireland) | the Passport reference you look up, and your IP address for the request | to show you the Passport |
Nothing else is loaded from a third party. The assessment page and the register talk only to our own service; when you sign in to the register, our server (not your browser) asks our authentication provider to send you a sign-in link — see the privacy notice.
If this ever changes
If we introduce any technology that stores or reads information on your device beyond what is strictly necessary to provide a page you asked for, we will first update this page, and we will either ask for your consent before it loads, or rely on the statistical-purposes exception in Schedule A1 with clear information and a simple, free way to object. Rejecting or withdrawing would stop the technology loading.
Your engagement code
The assessment page does not remember your engagement code between visits. Your draft answers are saved on our servers against your code, not on your device; to return to a draft, enter the code again.
Questions
contact@viccaone.com. See also our privacy notice.
Version history: 1.0 (12 October 2026); 1.1 (26 October 2026) — the two strictly necessary cookies of the signed-in register described. 1.2 (3 November 2026) — the register's cookies described for the organisations that use it; the rebuilt public pages still set no cookie and store nothing (measured).