Just the necessary bits.
No advertising cookies. No third-party trackers. Just what's needed to keep you signed in, save your progress, and — if you say yes — help us understand how the site is used.
Last updated: April 2026
Open the consent banner to adjust analytics at any time.
Two buckets: essential vs. analytics
Essential storage is non-negotiable — without it the site can't sign you in or remember what questions you've answered. This is enabled by default.
Analytics storage is optional. It helps us see which cases are working and which aren't. We can run the product without it — we just won't know as much. It's off by default and only turns on if you click "Accept all" in the banner.
The full inventory
| Key / cookie | Where | Purpose | Category | Expires |
|---|---|---|---|---|
sb-*-auth-token |
localStorage | Supabase session for signed-in users. Without this, you'd be signed out on every tab. | Essential | ~7 days, rotating |
bq_cookie_consent |
localStorage | Remembers your choice on this banner so we don't ask again. | Essential | 12 months |
bq_guest_state |
localStorage | Your guest progress — XP, streaks, completed cases, SRS schedule. Stays local; never leaves your browser unless you sign in. | Essential | Until you clear site data |
bq_last_email |
localStorage | Pre-fills the email field on the sign-in screen if you've logged in before. | Essential | Until you clear site data |
bq_visitor_id |
localStorage | A per-browser UUID used to count unique visitors and attribute guest activity to an eventual account. | Analytics | Until you clear site data |
bq_landing_variant |
localStorage | Records which version of the landing hero you saw (e.g. Twitter, LinkedIn) so we can measure conversion per channel. | Analytics | Until you clear site data |
bq_last_guest_visit |
localStorage | Timestamp used to de-duplicate guest-visit event logging (one log per browser per day, max). | Analytics | Until you clear site data |
Server-side events rows |
Supabase (our database) | Aggregate event log: page loads, cases started, answers, reports filed. Joined by visitor_id or your user ID. |
Analytics | Retained while account active |
| Vercel Web Analytics | Cookieless | Page-view counts + anonymized device type via /_vercel/insights/script.js. No personal identifiers, no cross-site tracking. |
Analytics | 90 days aggregated |
Items tagged Analytics are only written or sent if you click Accept all.
Common questions
Do you use advertising cookies?
No. We don't run ads, we don't profile visitors for advertising, and we don't embed Facebook pixels, Google Ads tags, or TikTok trackers. We never have.
What happens if I choose "Essential only"?
The site works completely. You can play as a guest, sign in, complete cases, earn XP, and sync progress. We just don't create a bq_visitor_id, don't tag the landing variant, and don't log activity events to our server. You won't appear on the analytics dashboard. Everything you care about as a user works identically.
What about Stripe, for Pro subscriptions?
If you subscribe, Stripe sets its own cookies at stripe.com — these are essential for fraud prevention and payment processing, and are set only on the checkout page. See Stripe's privacy policy for details. We don't receive or store your card number.
How do I clear everything?
Two paths:
- Revoke consent: click Open cookie settings above and choose Essential only. This immediately stops analytics writes. Existing
bq_visitor_idandbq_landing_variantentries are removed from localStorage. - Nuclear option: use your browser's site-data tools (Chrome: DevTools → Application → Storage → Clear site data; Safari: Privacy → Manage Website Data → Remove). This also signs you out.
To also delete server-side event history tied to your account, email info@biostatquest.com.
Will this list change?
If we add or remove anything material, we update the "Last updated" date at the top and re-prompt for consent (you'll see the banner again). Small behind-the-scenes tweaks are covered by the existing consent.