Cookie notice

1. Essential cookies and storage

These items are needed to provide a feature you request, protect the Service or remember a privacy/accessibility choice. They do not wait for optional-cookie consent.

Authentication session cookie

Keeps a signed-in account authenticated. It is protected with `HttpOnly`, `SameSite=Lax` and, in production, `Secure` attributes. It expires with the applicable login session or when cleared at logout.

CSRF security cookie

Helps prove that an account-changing request came from this website rather than a hostile page. It is scoped to this site and uses `SameSite=Lax` and production `Secure` protection.

Google sign-in security cookies

Google sign-in uses encrypted, HttpOnly security cookies to bind the callback to your browser, link an existing account, or confirm a sensitive action. They expire after at most 10 minutes; action confirmations expire after 5 minutes. They are essential cookies.

Accessibility and display preferences

Local storage remembers choices such as theme and text size on this device.

Cookie choice

Local storage records whether you accepted all cookies or kept only essential storage, so the banner can honour the choice. It remains until you change it, clear site data or the consent version changes.

Pending Analytics withdrawal

If a withdrawal request cannot reach our server, local storage keeps an anonymous deletion reference so we can retry. It is removed once confirmed. Unused references expire after 90 days and are cleared when you next use the site. Browser Analytics stays off while you have rejected optional cookies.

Snake high score

Playing Snake saves your highest score in the mrc-snake-high-score cookie for one year. It contains only a number, is scoped to /snake, and is not linked to your account or saved in our database.

2. Optional cookies

If you select “Accept”, Google Analytics (Google Ireland Limited) measures visits, registration, learning milestones and purchases to help us improve MRC. It uses the _ga and _ga_BMBPJP756Zcookies to distinguish browsers and visits. We set their lifetime to 90 days. Google’s tag remains blocked until you accept.

Advertising storage, Google signals and advertising personalisation are disabled. We do not send account names, email addresses, answers or card details. We send course, plan, purchase amount and refund amount with a random transaction reference, including from our server after payment is confirmed. We remove search text, URL queries and private identifiers, and exclude admin, settings and password-recovery pages. A random browser consent reference lets us stop pending server events when you withdraw consent on this device. This reference and associated checkout measurement are retained for up to 90 days. Google Analytics event-level data is retained for up to 14 months. Google may process measurement data outside the UK; see its privacy policy.

3. Changing your choice

Use the “Cookie settings” button in the website footer at any time. Choosing “Reject optional” stops Analytics and clears its cookies on this site. When our server receives the withdrawal, it stops pending measurement associated with this browser. Failed requests are retried when you return or reconnect. Already sent or in-flight events cannot be recalled by changing this choice. It does not prevent essential authentication, security or preference storage. You can also clear site data in your browser, which will cause the banner to ask again.

4. Browser controls

Browsers can block or delete cookies and local storage. Blocking essential items may prevent sign-in, security checks or saved display preferences from working correctly.