Cookie policy
Version 2026-08-27 · Effective 27 August 2026
Cookies are small files a site stores in your browser. We use as few as we can. Nothing that identifies you is set for advertising, and we do not sell data or share it with ad networks.
Strictly necessary
These make sign-in and security work. They cannot be switched off in the product, and they do not need consent. Some are stored in local storage rather than as cookies, which we have noted where that applies.
| Name | Purpose | Category | Retention |
|---|---|---|---|
schoolrota_session | Keeps you signed in to your school portal | Strictly necessary | Until sign-out or session expiry |
schoolrota_oidc | Protects the single sign-on handshake against request forgery | Strictly necessary | A few minutes, during sign-in only |
schoolrota_operator* | Sign-in, single sign-on, and multi-factor state for our own support console. Covers schoolrota_operator, schoolrota_operator_oidc, and schoolrota_operator_mfa_pending | Strictly necessary | Session, or minutes for the sign-in steps |
schoolrota_impersonation | Marks a support session where a member of our team is assisting with your consent, so it is banner-flagged and audit logged | Strictly necessary | 1 hour |
schoolrota_cookie_consent | Remembers whether you accepted or declined analytics. Stored in local storage, not a cookie | Strictly necessary | Until you clear site data |
Optional analytics
These are set on our public marketing pages only, and only if you press Accept on the cookie banner. They are never set inside a school portal, and they contain no staff or rota data.
| Name | Purpose | Category | Retention |
|---|---|---|---|
_ga, _ga_* | Google Analytics 4. Counts visits and pages viewed on our public marketing site so we can see what is useful | Optional analytics | Up to 2 years |
Changing your choice
If you declined, no analytics cookies are set. If you accepted and want to change your mind, clear site data for this domain in your browser settings and the banner will appear again on your next visit. You can also block or delete cookies in your browser at any time, though blocking strictly necessary cookies will stop sign-in from working.
Your school portal
Portals at your own subdomain use only strictly necessary cookies. If your school connects single sign-on, your identity provider may set its own cookies under its own policy.
More information
See our privacy policy for how we handle personal data, and our sub-processor list for who processes it. Questions: hello@schoolrota.com.