Cookie Policy
Cookie Policy
Bruukki - Learning Material Creator Platform
Effective Date: February 1, 2026 Last Updated: August 25, 2026
1. Introduction
This Cookie Policy explains how Bruukki ("we", "us", "our") uses cookies and similar technologies on our website and platform. This policy should be read together with our Privacy Policy.
2. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They help the website remember your preferences and understand how you use the service.
Types of Storage Technologies
| Technology | Description |
|---|---|
| Cookies | Small text files stored in your browser |
| Local Storage | Browser storage for larger amounts of data |
| Session Storage | Temporary storage cleared when browser closes |
Besides the cookies listed in Section 3, we keep a small amount of short-lived interface state in your browser's local and session storage. It covers things like the panel widths and collapsed sections you last used, whether you have already seen the new-feature list or the small-screen notice, where to return you after you sign out, and unfinished form input carried between two steps of the same flow. None of it is used to identify you or to track you across sites, and clearing your browser storage removes all of it.
3. How We Use Cookies
3.1 Strictly Necessary Cookies
These cookies are essential for the Service to function. They cannot be disabled.
| Cookie | Purpose | Duration |
|---|---|---|
bruukki_session_id | Maintains your signed-in session. HTTP-only, so page scripts cannot read it. | 24 hours |
bruukki_preconsent_session | Holds your sign-in while you read and accept the Terms of Service and Privacy Policy, before an account session exists. HTTP-only. | 10 minutes |
oauth_state | Protects the "Continue with Google" / "Continue with Microsoft" redirect against CSRF. HTTP-only. | 10 minutes |
oauth_return_url | Remembers which page to return you to after sign-in. HTTP-only. | 10 minutes |
__ctx_refresh | Tells the next page load to re-read your workspace and role from the server instead of a cached copy, after you switch workspace, rename or delete one, or finish a guided tour. | 10-30 seconds |
Legal Basis: Legitimate interest (service provision)
3.2 Functional Cookies
These cookies remember your preferences and settings.
| Cookie | Purpose | Duration |
|---|---|---|
bruukki_locale | Your chosen interface language in the teacher application | 180 days |
bruukki_learner_locale | Your chosen interface language on shared learner pages, which need no sign-in | 180 days |
sidebar_state | Whether the navigation sidebar is expanded or collapsed | 7 days |
bruukki_features | Feature-flag overrides for internal testing. Set only through an internal QA endpoint, never by the application's own interface. | 1 year |
Legal Basis: Legitimate interest (user experience)
3.3 Analytics
We do not use analytics cookies. For marketing-site traffic (bruukki.com) we use Plausible Analytics — an EU-based (Estonia), cookieless analytics service that collects only anonymous aggregate data. It does not set cookies and does not store personal data, so no consent is required.
In addition to the client-side page analytics described above, we also send a small number of server-side events from our backend (AWS Lambda) to Plausible — specifically a Signup custom event when a user creates an account, with anonymous properties such as the authentication method and any UTM campaign attribution. These events contain no user identifiers (no name, no email, no user ID) and are sent with synthetic request headers so that visitor IP is not recorded. They remain anonymous aggregate analytics data.
| Service | Processing | Privacy Policy |
|---|---|---|
| Plausible Analytics | Anonymous aggregate website analytics (client-side page views + server-side signup events; no cookies, no personal data) | plausible.io/privacy |
For authenticated users, product usage analytics is based on server-side event tracking and does not require cookies or third-party scripts. This product-usage analytics is also forwarded server-side from our backend to PostHog (EU Cloud, hosted in Frankfurt) for aggregate funnel, retention and feature-usage analysis. PostHog receives only pseudonymized events (no direct identifiers, no content); it sets no cookies and runs no scripts on our site, so this does not change the consent position described in Section 4.2. We do not track:
- Content of your materials
- Keystrokes or form inputs
- Cross-site behavior
Legal Basis: Legitimate interest (service improvement; no personal data involved)
Marketing email engagement. Our lifecycle/marketing email is sent via Brevo (an EU-based provider — see the Privacy Policy subprocessor list; in production since July 2026). Marketing emails sent to users who have opted in to marketing include open- and click-tracking so we can measure engagement. This is email engagement tracking, not a website cookie, and it applies only to consented recipients.
Embedded Brevo registration form on webinar pages. Since August 2026, webinar pages on bruukki.com (/fi/webinaarit/) embed a Brevo registration form loaded from Brevo's sibforms.com domain. The embedded form sets no cookies and stores nothing in your browser (verified 2026-08-10). Details you submit through it (name and email address) are processed as described in the Privacy Policy.
3.4 Third-Party Cookies
We may use the following third-party services that set their own cookies:
| Service | Purpose | Lifespan | Privacy Policy |
|---|---|---|---|
| Stripe Checkout | Payment processing — Stripe sets cookies on its own checkout domain (checkout.stripe.com) for payment fraud prevention, including the Stripe Radar device-fingerprinting signal. Cookies are set only when you reach the Stripe-hosted checkout from a Bruukki upgrade flow; no Stripe cookies are set on Bruukki's domain. | Session + persistent (typically up to ~12 months). Canonical list and exact durations: stripe.com/cookies-policy. | Stripe Privacy |
| Google (OAuth sign-in) | Set by accounts.google.com only when you choose "Continue with Google" and only on Google's own domain during the sign-in redirect — used by Google to authenticate you to your Google account. No cookies are set by Google on Bruukki's domain. | Per Google's policy | Google Privacy |
| Microsoft (Entra ID OAuth sign-in) | Set by login.microsoftonline.com only when you choose "Continue with Microsoft" and only on Microsoft's own domain during the sign-in redirect — used by Microsoft to authenticate you to your Microsoft account. No cookies are set by Microsoft on Bruukki's domain. | Per Microsoft's policy | Microsoft Privacy |
Legal Basis: Consent (where required) — for the Stripe Checkout cookies the user's choice to proceed to checkout constitutes the consent action; for OAuth sign-in cookies the user's choice to click "Continue with Google" / "Continue with Microsoft" constitutes the consent action.
3.5 California and other US users (CCPA / CPRA)
For consumers in California, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants rights over personal information, including cookie-based identifiers. Our cookie use is limited to the strictly necessary and functional cookies in Sections 3.1–3.2 and the third-party payment and sign-in cookies in Section 3.4. We do not use advertising or cross-site tracking cookies, and we do not use analytics cookies (our marketing-site analytics is cookieless — Section 3.3).
Because of this:
- We do not "sell" your personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. There is accordingly no "Do Not Sell or Share My Personal Information" cookie choice to make — we do neither.
- The only cookies that involve a third party are Stripe (payment fraud prevention) and Google / Microsoft (OAuth sign-in), each set on that provider's own domain to deliver a service you requested, not for advertising.
Your broader CCPA/CPRA rights (to know, delete, correct, and how to exercise them) are described in Section 14 of our Privacy Policy. This posture reflects our current cookie usage; if we later introduce analytics or advertising cookies, we will update this section and provide the corresponding opt-out.
4. Cookie Consent
4.1 Current Cookie Usage
We currently use only strictly necessary and functional cookies that do not require consent under ePrivacy Directive. If we introduce analytics or third-party cookies in the future, a consent banner will be displayed before such cookies are set.
4.2 Managing Cookies
You can manage cookies through your browser settings (see Section 5). Note that blocking strictly necessary cookies may prevent the Service from functioning correctly.
4.3 Withdrawing Consent
If consent-based cookies are introduced in the future, you will be able to withdraw consent at any time. Withdrawal will:
- Stop future data collection via those cookies
- Not delete data already collected (contact us for deletion)
5. Managing Cookies in Your Browser
You can control cookies through your browser settings:
| Browser | Instructions |
|---|---|
| Chrome | Settings → Privacy and Security → Cookies |
| Firefox | Settings → Privacy & Security → Cookies |
| Safari | Preferences → Privacy → Cookies |
| Edge | Settings → Privacy → Cookies |
Note: Blocking all cookies may affect Service functionality.
6. Cookie Retention
| Category | Retention |
|---|---|
Session cookie (bruukki_session_id) | 24 hours, or until sign-out |
| Short-lived sign-in cookies (OAuth state, pre-consent) | 10 minutes |
Cache-refresh cookie (__ctx_refresh) | 10-30 seconds |
| Functional cookies (Section 3.2) | 7 days to 1 year |
| Analytics cookies | Not used (Section 3.3) |
7. Do Not Track
Some browsers support "Do Not Track" (DNT) signals. We currently do not use analytics cookies, so DNT signals do not affect Service functionality. If analytics cookies are introduced, we will respect DNT signals by disabling them for users who have enabled DNT.
8. Updates to This Policy
We may update this Cookie Policy to reflect changes in our practices or for legal reasons. Changes will be indicated by the "Last Updated" date.
9. Contact Us
For questions about our use of cookies:
Email: privacy@bruukki.com
10. More Information
For more information about cookies and your rights:
- Your Online Choices (EU)
This Cookie Policy complies with EU ePrivacy Directive and GDPR requirements.