Cookie Policy

Last updated: 8 September 2026

This page lists every cookie and browser-storage entry portal.skillcard.pro can set. It covers the portal only; the marketing site at skillcard.pro has its own cookie notice and its own consent banner.

The portal shows no cookie banner, because by default it sets no cookie that needs consent. Everything in the first table below is strictly necessary to deliver a service you asked for, which § 103¹ of the Estonian Electronic Communications Act and Article 5(3) of the ePrivacy Directive exempt from consent. The one non-essential technology we use is session recording, and it is off until you switch it on.

Strictly necessary — always set

Cookies that are strictly necessary to run the portal
Name	Purpose	Expires	Legal basis
`authjs.session-token (__Secure-authjs.session-token over HTTPS)`First-party, HTTP-only	Keeps you signed in. Without it every page would ask for your password again.	30 days, or until you sign out	Strictly necessary — no consent required
`authjs.csrf-token`First-party, HTTP-only	Protects sign-in and account forms against cross-site request forgery.	Session	Strictly necessary — no consent required
`authjs.callback-url`First-party, HTTP-only	Remembers which page you were heading to so sign-in returns you there.	Session	Strictly necessary — no consent required
`pending_invite`First-party, HTTP-only	Holds the club invite code from the link you opened so the signup form can attach you to the right club. It contains the invite code only.	2 hours	Strictly necessary — no consent required

Set only with your consent

Cookies that are only set after you opt in
Name	Purpose	Expires	Legal basis
`ph_<project-key>_posthog (plus matching ph_ localStorage entries)`First-party, readable by JavaScript	Set by PostHog only if you switch on session recordings. Ties the pages you visit into one replay so we can see where the portal is confusing.	12 months, or until you withdraw consent	Your consent — off by default

Session recording is opt-in, offered only to users aged 13 or over, and can be switched off at any time under Settings → Privacy. Turning it off stops recording immediately and deletes these cookies and storage entries from your browser. What a recording contains, and how long we keep it, is described in the Privacy Policy.

Analytics without cookies

We measure how the portal is used with PostHog, hosted in the EU (Frankfurt), but we configure it to keep its state in memory only. It sets no analytics cookie and writes nothing to local storage, so the measurement stops the moment you close the tab and cannot follow you between visits or across sites. Events reference a random account identifier, never your name, email or birth year.

Requests go to /ingest on this domain, which forwards them to PostHog. That is a first-party proxy so that privacy blockers do not break the page — it is not an attempt to evade them, and it collects nothing extra.

Third parties that set their own cookies

The portal embeds no advertising pixels, no social buttons, no chat widget, no maps and no video players. The only third party that runs in the page is Stripe.

Stripe.When — and only when — you open the payment form, we load Stripe's checkout script and it sets its own cookies (__stripe_mid, roughly a year, and __stripe_sid, 30 minutes). Stripe uses them to process the payment and to detect fraud, which makes them strictly necessary for a transaction you asked for. Nothing Stripe sets is loaded on pages where you are not paying. Stripe acts as its own controller for fraud prevention; see stripe.com/privacy.

Montonio.Bank-link payments leave the portal entirely and continue on Montonio's and your bank's own sites, under their own cookie notices. Nothing is embedded here.

Fonts are served from this domain, not from Google Fonts, so no request about you goes to a font host.

Things that are not cookies

Your browser also keeps a small amount of local storage for the app itself — for example remembering that you have already seen a prompt. This never leaves your device, and clearing your browser data removes it.

Managing cookies

Every browser lets you view, block and delete cookies for a site. If you block the strictly necessary ones the portal cannot keep you signed in, so most of it will not work. Questions about anything on this page: skillcard@skillcard.pro.