Cookie Policy

SMASH EDUCATION INC.

Cookie Policy

ENGLISH

Effective date: 8 October 2026

Table of Contents

content.section1.text27

content.section1.text28

content.section1.text29

1. Scope and purpose

Smash Education Inc. ("Smash Education", "we", "our") uses cookies and similar browser technologies to operate, protect and support its public website and educational platform, including the shared sign-in experience and the student, teacher and administrator areas. This policy explains the technologies, their purposes, the information involved, retention and user controls.

For our broader personal-information practices, please consult our Privacy Policy.

2. Cookies and browser storage

Cookies are small files that a website places on a device. Browser storage, including HTML5 local storage, is a separate technology that can preserve application settings or temporary activity information. This policy addresses both because they may involve access to or storage of information on a device.

3. Technologies we use

3.1 First-party authentication and security cookies

We use HTTP session cookies for authentication, verification of user roles, access control and session security. These cookies contain encrypted or pseudonymous authentication tokens (including JWTs) and user-type identifiers; sensitive profile details are not stored directly in the cookies. Our documented configuration uses Secure, HttpOnly and SameSite protections and encrypted HTTPS communications. Cookies are session-based or use a short rolling duration and expire on logout or at the end of the applicable authentication period. These first-party cookies are not disclosed to unrelated third parties.

3.2 Essential browser storage

HTML5 browser storage supports the interface and interactive learning experience. Depending on the feature, it may hold the interface language, sound or audio preferences, temporary exercise or mission progress, session-related application state and technical identifiers used for real-time communications (including SignalR). These values are used for platform operation, not advertising, and are generally cleared on logout, completion of the relevant activity, application cleanup or when browser data is cleared. Some preferences may persist until changed or cleared.

3.3 Google reCAPTCHA

Google reCAPTCHA helps protect public login and account-recovery endpoints against bots, brute-force attempts and other automated abuse. In providing this protection, Google may process browser-environment information, technical signals and interaction patterns and may use its own cookies or comparable technologies. Smash Education does not send student grades, passwords or student profile records to reCAPTCHA for this purpose. Google may process relevant technical data outside Canada, including in the United States. For details of Google’s practices, see Google’s Privacy Policy and Terms of Service.

3.4 Optional single sign-on

If enabled by the relevant institution or account configuration, users may authenticate through Google Workspace for Education, Microsoft Entra ID or Apple Sign-In. The identity provider may use cookies on its own domain to complete authentication. Depending on the provider, the federated subject identifier, institutional email address and display name may be processed for sign-in. Those providers govern their own cookies and retention practices under their applicable notices.

3.5 Application diagnostics

Smash Education uses Sentry for error reporting, crash diagnostics and application stability monitoring. Information processed may include exception traces, browser or operating-system environment details and performance metrics. Sentry is used for operational diagnostics, not advertising or marketing tracking. Diagnostic processing is distinct from the essential session cookies described above.

4. No advertising or third-party marketing analytics

Smash Education does not use advertising cookies, marketing pixels, web beacons, cross-site advertising identifiers or third-party marketing analytics cookies. We do not track students or teachers across other websites for behavioural advertising or commercial profiling.

5. Retention and recipients

First-party authentication cookies are temporary, with session-based or short rolling expiry. Browser-storage retention varies by function and may continue until logout, activity completion, application cleanup or user deletion. Google reCAPTCHA and optional identity providers may apply their own retention periods. First-party session cookies are exchanged with Smash Education servers; Google and selected identity providers receive technical or authentication information necessary to provide their respective services. Sentry processes diagnostic data for platform reliability.

6. Your choices

You can view, restrict or delete cookies and local storage through your browser settings. Disabling essential technologies may prevent sign-in or interrupt educational functions. The "Got it" button in our notice acknowledges that you have seen the information; it is not a request for consent to advertising or optional tracking. If we introduce technologies requiring consent, we will provide appropriate choices before using them where required.

7. Children and educational users

Our technologies are used to support secure educational services, including those accessed by children and students. We do not use student learning activity for behavioural advertising. Any parental, institutional or other legally required authorization for processing personal information is addressed through the relevant privacy and account processes; a cookie-notice acknowledgement does not replace those requirements.

8. Changes and contact

We may update this policy when technologies, providers, services or legal requirements change. The effective date above will identify the current version. For privacy questions or requests, use the contact details provided in our Privacy Policy.