This page explains which cookies and similar technologies QMA uses and how you control them. It is a standalone document with its own URL; who exactly processes your data and where it is transferred is set out in the Privacy Policy.

What cookies are

Cookies are small files stored by your browser. We also use similar browser storage (localStorage / sessionStorage) — the law treats these the same way, so we list them together. We group them into three categories.

Categories and what we actually store

1. Essential (no consent required)

Required for login, security and basic operation. They cannot be turned off — without them you cannot sign in. Specifically:

• __Secure-next-auth.session-token — your sign-in session cookie (plus the related CSRF-protection and callback cookies). Lasts for the session and is cleared when you sign out.
• cookie-consent (localStorage) — your cookie-consent choice and the time you made it. Stored so the banner does not keep asking, and so your choice is demonstrable.
• app-language (localStorage) — your selected interface language.

The site is additionally protected by the Cloudflare network, which for security reasons (attack and bot protection) may set its own strictly-necessary cookie and processes your IP address. Details are in the Privacy Policy.

2. Analytics (only after your consent)

They help us understand how the site is used so we can improve it — which pages people read, where they leave, what is unclear. We use a single analytics tool: PostHog, running in its European region (eu.i.posthog.com). It stores cookies and localStorage entries beginning with "ph_".

• Until you consent the analytics script is NOT LOADED at all — it is not merely "not measuring". It is not on the page.
• An anonymous visitor has no person profile at the analytics provider; one is created only after sign-up, so we can evaluate whether the service is understandable to new users.
• We keep analytics data in aggregated form for a maximum of 14 months.

3. Marketing

As of today we use NO third-party advertising or remarketing tracking technologies — no ad pixel, no ad-network measurement tag. The "Marketing" toggle in the consent banner is therefore an empty slot for now: turning it on starts nothing. If that ever changes, we will update this page and the Privacy Policy first, and only then the site.

Your consent and how to withdraw it

• On your first visit a consent banner appears. You can choose "Essential only", "Customize" or "Accept all" — declining is as easy as accepting, and declining costs you nothing in the service.
• Consent is voluntary and you can withdraw it at any time: clear the site data (cookies and storage) in your browser settings. The banner will show again so you can choose differently; capturing stops immediately.
• Your browser settings let you block or delete cookies across the board. Blocking essential cookies will, however, make signing in impossible.

Who the analytics provider is

Analytics is processed for us by PostHog. Data is stored in its European (EU) region; the provider (PostHog, Inc.) is based in the United States, so any access from outside the EEA is covered by the European Commission’s Standard Contractual Clauses. The full list of processors, legal bases and international-transfer rules is in the Privacy Policy.

Questions: [email protected]