sessionid
First-party session cookie. It keeps an authenticated user signed in. Strictly necessary. Default duration is up to 12 hours and it normally ends when the browser closes.
csrftoken
First-party security cookie used to prevent forged form submissions. Strictly necessary. Django controls its duration.
cq_consent
First-party signed cookie that remembers preferences and the consent configuration version. Strictly necessary to remember a reject or accept choice. It lasts for the configured consent period.
Browser storage
The application does not use localStorage, sessionStorage, IndexedDB, a service worker, advertising pixels or analytics identifiers. Pyodide code runs in a browser worker and is delivered from jsDelivr when a coding activity is opened.
Changing choices
Use Cookie choices in the footer at any time. Rejecting optional categories does not prevent core learning, login or security features.