The short version
EZ Recert sets up to eight cookies. Six are needed for the site to work: one keeps you signed in, four remember that you closed a banner, and one exists only while a support session is running. The seventh remembers your answer about analytics. The eighth belongs to PostHog, the analytics service we use to count page visits and clicks, and it is set only if you allow it. There are no advertising cookies and no cross-site trackers.
We do not ask about the six, because refusing a session cookie is the same as refusing to sign in. We do ask about PostHog's. Until you answer, and if you don't allow it, PostHog counts visits without any cookie. You can change your answer under turning cookies off, further down.
Cookies we set
Every one of these is first-party, is marked HttpOnly so no script on the page can read it, is marked Secure in production so it travels only over HTTPS, and is set SameSite=Lax so it is not sent along with requests started by another site.
| Name | What it does | How long it lasts |
|---|---|---|
ezr-auth | Keeps you signed in. It holds the two tokens your session is made of, and it is written when you sign in and cleared when you sign out. | 30 days, matching the lifetime of the session itself |
ezrecert-void-dismissedezrecert-remac-void-dismissedezrecert-sent-back-dismissedezrecert-remac-sent-back-dismissed | Remember that you closed a notice on your dashboard — that a packet was voided, or that one was sent back to you. Four separate names because the four notices are dismissed independently. Each holds a short token identifying the notice it closed, and nothing about you. | A year, though the token stops matching as soon as you resubmit, which is usually much sooner |
ez-impersonation-stash | Set only for the platform operator, and only while they are viewing the service as somebody for support. It holds the operator's own session, sealed, so they can be returned to it afterward. It is deleted when the support session ends. If you are not the operator, this cookie is never set in your browser. | The support session, and no longer |
The analytics cookies
Until you allow its cookie, PostHog stores nothing in your browser, and its servers tell visits apart without one.
If you allow it, PostHog's script sets one cookie on this site's own domain. Its name starts with ph_ and ends with _posthog. It holds a random identifier for your browser and the start time of your current visit, and it lasts a year. PostHog's script has to read it, so it is not HttpOnly like the six above.
Your answer is kept in a cookie named ezr-analytics. It holds granted or denied and nothing about you, and it lasts a year, after which we ask again. The banner's script writes it, so it is not HttpOnly either.
The Privacy Policy lists what PostHog receives. PostHog does not run on the pages a student opens from a course link, or on the unsubscribe page.
Cookies set by somebody else
One third party besides PostHog can set storage in your browser through this site, and only in one circumstance.
| Who | When it loads | What it is for |
|---|---|---|
| Cloudflare Turnstile | On the sign-in, sign-up, forgotten-password and reset-password pages, with the page. On the public marketing pages, not until you begin filling in the contact form — read the site and leave without touching it and nothing reaches Cloudflare at all. | Telling a person from a script, so those five forms are not usable by bulk automated submission. Cloudflare's widget runs in your browser and may use its own storage to do that. It is a privacy-preserving challenge rather than a tracker, but it is theirs rather than ours, and it is governed by their terms. |
Apart from Turnstile and PostHog, nothing third-party loads on this site. The one webfont the marketing footer uses is served from our own domain rather than fetched from Google, and the site is served directly rather than through a CDN that would set a cookie of its own.
Other things stored on your device
These are not cookies — they are never sent to us with a request, and we cannot read them. They are listed because they are still your storage and you may want to clear them.
| What | Where | What it holds |
|---|---|---|
| Theme preference | localStorage, under theme | Whether you chose light, dark, or to follow your system. |
| Install prompt | localStorage, under ezrecert:install-dismissed | That you dismissed the card offering to install EZ Recert to your home screen, so it stops offering. |
| PostHog analytics | localStorage, under the same name as the analytics cookie | A copy of what the analytics cookie holds, written only if you allow the cookie. PostHog's script reads it; our server does not. |
| PostHog's note of your answer | localStorage, under a name starting __ph_opt_in_out_ | Whether you allowed PostHog's cookie, written once you answer. It holds a 1 or a 0. |
| Service worker | Your browser's service worker storage | A small script that lets EZ Recert open offline and receive push notifications. It is registered for everyone; it delivers push only if you switch push notifications on yourself, per device. |
| Push subscription | Your browser, and a copy on our server | Created only when you turn push notifications on. It is an address your browser vendor issues for your device, which we use to send the notification. Turning push off in your profile deletes our copy. |
What we do not do
- No advertising cookies, and no ad networks anywhere on the site.
- No session recording, no heatmaps and no performance beacons. PostHog counts page visits and clicks, and we mask the text of whatever you click.
- No cross-site tracking, no fingerprinting, and no data broker or ad exchange receives anything from this site.
- No tracking pixels in our email, and no rewriting of the links in it. We record whether the provider accepted, deferred or failed a message, which is a fact about the transport rather than about you opening it.
- Session replay is deliberately switched off in our error monitoring. It records the page, and pages here carry addresses and license numbers.
Turning them off
Your browser can block or clear cookies for this site, and every browser offers it in settings. Two consequences worth knowing before you do:
- Blocking
ezr-authmeans you cannot stay signed in. There is no fallback; the sign-in will appear to succeed and drop you back at the form. - Clearing the notice cookies brings those banners back. Nothing else changes, and no record of yours is affected.
- Clearing the
ezr-analyticscookie brings the analytics question back, and PostHog goes back to counting without a cookie until you answer. - Not allowing PostHog's cookie stops the cookie, not the counting. A content blocker that blocks PostHog stops both, and the site works the same with PostHog blocked.
Clearing site data also clears the theme preference and the install-prompt dismissal above, and unregisters the service worker, which switches push notifications off on that device until you turn them on again.
Changes to this page
This inventory is meant to be complete on the day it is dated. If a cookie is added — particularly one that is not strictly necessary — this page is updated before it ships, and anything requiring your consent will ask for it rather than appear here quietly.
The Privacy Policy covers everything else EZ Recert LLC holds about you, and the Terms of Service cover the rest of the relationship. Questions about any of it go to support@ezagencyos.com.