Cookie Policy
Last updated: 17 August 2026
This page lists every cookie and every piece of browser storage that Listening, no kidding uses. The list is short, and it is complete.
We do not show a cookie banner, because we do not need your consent.
Every item below is strictly necessary to deliver a service you asked for, which Article 5(3) of the ePrivacy Directive exempts from consent. We run no analytics, no advertising, no tracking pixels and no social-media tags. If that ever changes, a consent banner will appear before the first non-essential cookie is set — not after.
1. What cookies are
Cookies are small text files a site stores on your device. Browsers also offer local storage, which does the same job with more room and no automatic expiry. The law treats both the same way, so both are listed here.
2. Cookies we set
| Name | Set by | Purpose | Expires |
|---|---|---|---|
| __nk_session | Us (Firebase Auth) | Keeps you signed in across English, Writing and Listening, no kidding. HTTP-only, Secure, SameSite=Lax — not readable by scripts. | 5 days |
| sidebar_state | Us | Remembers whether you left the dashboard sidebar open or collapsed. | 7 days |
That is the entire cookie list. Both are first-party: no other domain can read them.
3. Local storage we use
| Key | Purpose | Cleared |
|---|---|---|
| nk-theme | Remembers your light or dark theme choice. | When you clear site data |
| liveSession:* | Holds the name and participant id you chose for a live session in progress, so refreshing the page does not eject you from the session. | When you clear site data |
| liveSession:lastJoinCode | Pre-fills the last join code used on this device. | When you clear site data |
Firebase Authentication also keeps your login token in local storage under keys beginning firebase:authUser:. That is how the sign-in survives a page reload; clearing it signs you out.
4. Third parties that see your browser
No third party sets cookies through our pages, but two connections send your IP address to another company, which is worth stating plainly:
- Google Fonts. The interface loads typefaces from fonts.googleapis.com. The request reveals your IP address and browser to Google. No cookie is set.
- Stripe.If you open the checkout or billing portal, you are on Stripe’s own pages, and Stripe sets its own cookies there for fraud prevention. That is governed by Stripe’s privacy policy. Fraud prevention cookies of this kind are treated as strictly necessary.
Lessons that embed an external player load it from that provider’s domain only after you press play, and where a privacy-enhanced embed exists we use it.
5. Managing cookies
You can delete or block cookies in your browser settings, and clear local storage along with them. Because everything we set is strictly necessary, blocking it will sign you out and break live sessions — but nothing you block will cost you anything else, since none of it tracks you.
Do Not Track and Global Privacy Control
We honour both signals by default, in the simplest possible way: there is nothing to turn off, because we do not track you in the first place.
6. Changes and contact
If we add a cookie, this page changes first. Questions go to privacy@listeningnokidding.com. For what happens to the data behind these cookies, see the Privacy Policy.