Cookie Policy
Last updated: 12 October 2026
What are cookies?
Cookies are small text files placed on your device by a website. They help the site function correctly and remember your preferences between visits. This policy also covers similar technologies we rely on, including browser local storage, which the UK Information Commissioner's Office treats the same way as cookies for transparency purposes.
Cookies we use
Strictly necessary cookies (always active)
These cookies are essential for MyPKU to work. Without them you cannot log in or use the service reliably. Under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR, consent is not required for strictly necessary cookies; we disclose them here so you know what is set and why.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
AWSALB, AWSALBCORS | Load-balancing “sticky session” cookies. Keep your browser pinned to the same server during a request, which prevents partial page loads and errors during deployments. Set automatically by our infrastructure. | AWS (Application Load Balancer) | Our server honours it for 10 minutes. The cookie itself can stay in your browser for up to 7 days |
Payment cookies (subscription page only)
If you visit the subscription page, Stripe may set cookies to process payments securely and prevent fraud. These are considered strictly necessary because they are set in connection with a payment service you have explicitly requested. See Stripe's Cookie Policy for details.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
__stripe_mid | Fraud prevention for payment processing | Stripe | About 1 year |
__stripe_sid | Fraud prevention for payment processing | Stripe | 30 minutes |
Browser local storage (similar technologies)
MyPKU stores some information directly in your browser's local storage rather than in cookies. Local storage works differently from cookies (it is not sent to our servers automatically), but the UK ICO treats it the same way for transparency, so we disclose it here too. All entries below are strictly necessary for the service to function.
| Key | Purpose | Provider | Duration |
|---|---|---|---|
CognitoIdentityServiceProvider.<clientId>.* | Stores your authentication tokens (ID, access, refresh) so you stay logged in between page loads. Removed automatically when you sign out or when the refresh token expires. | AWS Amplify / Cognito | Up to 30 days (refresh-token lifetime) |
mypku-cookie-acknowledged | Records that you have seen the cookie notice so we don't show it again. | MyPKU | Persistent (until you clear browser storage) |
social-guidelines-last-shown | Records when you last saw the community guidelines reminder, so we show it about once a week rather than every visit. It holds a timestamp only. | MyPKU | Persistent (until you clear browser storage) |
social-guidelines-version | Records which version of the community guidelines you last saw, so we show them again when they change. It holds a version date only. | MyPKU | Persistent (until you clear browser storage) |
mypku.selectedSubjectId | Remembers which person's diary you were last viewing, if you keep records for more than one person, so it opens on the same person next time. It holds an internal identifier, not a name. | MyPKU | Persistent (until you clear browser storage). Removed if that person is no longer available to you. |
mypku.returnTo | Session storage. If you open an invitation or hand-over link before signing in, remembers the link so we can take you back to it after you sign in. It holds the page path only. | MyPKU | Until you sign in and are returned to the link, or you close the tab |
The MyPKU app
The app sets no cookies. It keeps the following on your phone, all strictly necessary for the app to work. It is removed when you sign out or delete your account, unless noted.
| Item | Purpose | Duration |
|---|---|---|
mypku.exchanges.<account>.v1 | Your offline exchange log, so the app works without a connection. It is sent to our servers when you are back online. | Until you sign out or delete your account |
mypku.exchanges.<account>.subject.<person>.v1 | The same offline exchange log for each other person whose record you can see, so the app works without a connection for them too. It is sent to our servers when you are back online. | Until you sign out, delete your account, or your access to that person ends |
mypku.selectedSubject.<account>.v1 | Remembers which person you last viewed, so the app opens on them. | Until you sign out or delete your account |
mypku.socialGuidelines.<account>.v1 | Records which version of the community guidelines you have seen and when, so we show them again when they change and as a weekly reminder. It holds a version date and a timestamp only. | Until you sign out or delete your account |
mypku.appLock.<account>.v1 | Records that you have turned on the unlock prompt (fingerprint, face or PIN). It is off unless you turn it on, and holds a single marker, not a biometric. | Until you turn it off, sign out or delete your account |
Sign-in tokens (mypku_ss_*) | Keep you signed in. They are held in the phone's secure storage (Keychain or Keystore), split into small parts. | Until you sign out or the refresh token expires |
| Data export file | A temporary copy of your data download or diary spreadsheet, so you can save or share it. | Deleted once saved or shared |
Analytics (cookieless)
We use Umami Cloud to measure aggregate usage of MyPKU (which pages and features are used most). Umami sets no cookies. We use it only for statistics, to improve MyPKU. We tell you about it here and in the Privacy Policy, which describes what Umami receives and how it is hosted, and you can opt out at any time, free of charge, below. If you opt out, your browser stores a single note saying so (umami.disabled), so that Umami stops counting your visits. Clearing your browser storage removes the note, and you would need to opt out again.
Opt out of analytics
Usage statistics are on in this browser.
What we do not use
MyPKU uses no advertising cookies and does not use Google Analytics, Facebook Pixel, or any similar tracking tool that profiles individual visitors. If we ever introduce non-essential cookies, we will ask for your explicit consent through an updated cookie banner before any are set.
Managing cookies and local storage
You can control or delete cookies and local storage through your browser settings. Please be aware that blocking the strictly necessary cookies and storage entries listed above will prevent you from logging in to MyPKU or using the service reliably.
Changes
We will update this policy if we introduce new cookies or change how existing entries work. Check the “last updated” date above for the current version. Recent changes:
- 12 October 2026: Added an opt-out for analytics and reworded how we describe it. Added the lifetimes of the Stripe cookies, and corrected how long the load balancer cookie lasts.
- 11 October 2026: Replaced the
amplify-*entry, which we do not use, with the real sign-in storage keys. Added the three storage entries for the diary person, return link and community reminder, and a section on what the mobile app keeps on your phone. - 4 May 2026: Disclosed ALB sticky-session cookies (
AWSALB/AWSALBCORS) added to support reliable deployments. Re-categorised the Cognito and Amplify auth entries as browser local storage rather than cookies (no functional change; the previous policy described the storage mechanism inaccurately).