DRAFT — under legal review

Cookie Policy

Last updated: October 2026

SkillPass.ID only uses cookies and browser storage that are strictly necessary for the service or that remember your settings. We do not use statistics, analytics or marketing cookies. This policy lists by name what we store on your device, why, on which domain and for how long.

1. What is a Cookie?

A cookie is a small text file stored on your device by a website. Cookies are used to remember information about the user (e.g., login status, preferences).

2. What Cookies Do We Use?

a) Strictly necessary cookies (no consent required, GDPR Art. 6(1)(b) and the ePrivacy exemption): — ory_kratos_session — sign-in session (Ory Kratos). Domain: skillpass.id (shared by auth.skillpass.id and skillpass.id). Lifetime: 720 hours (30 days). Attributes: HttpOnly, Secure, SameSite=Lax. — csrf_token_… (name with a suffix) — CSRF protection of the sign-in, registration and settings forms (Ory Kratos). Domain: skillpass.id. Lifetime: 1 year. Attributes: HttpOnly, Secure, SameSite=Lax. — ory_hydra_session — single sign-on (SSO) session towards partner sites (Ory Hydra). Domain: skillpass.id. Lifetime: at most 720 hours (30 days). Attributes: HttpOnly, Secure, SameSite=None (required for redirects from partner sites). — ory_hydra_login_csrf and ory_hydra_consent_csrf (the name may carry a suffix) — CSRF protection of partner sign-in and consent (Ory Hydra). Domain: skillpass.id. Lifetime: the duration of the flow, at most 30 minutes. Attributes: HttpOnly, Secure, SameSite=None (required for redirects from partner sites). — sp_ref — carries the invite code from an invite link through registration. Domain: skillpass.id (shared). Lifetime: 7 days, deleted when the first account setup (onboarding) is completed. Attributes: HttpOnly, Secure, SameSite=Lax. b) Preference cookies: — NEXT_LOCALE — your chosen language (hu/en). Domain: skillpass.id and auth.skillpass.id (separately per host). Lifetime: 1 year. Attributes: Secure, SameSite=Lax. — sp_theme — your chosen theme (light/dark), so the page loads in the right theme without flashing. Domain: skillpass.id. Lifetime: 1 year, deleted on sign-out. Attributes: Secure, SameSite=Lax. c) Browser storage (not a cookie, never sent to the server): localStorage (kept until you clear your browser data): — skillpass-cookie-consent — your choice in the cookie notice and its version (on both hosts). — skillpass-appearance — appearance settings (theme, sidebar, density, accessibility mode). — skillpass-sidebar-collapsed — whether the sidebar is collapsed. — skillpass-launcher-favs — apps marked as favourites in the app launcher. — skillpass-known-accounts — accounts used in this browser, for the quick account switcher (email address, name, initials, last use); contains no password or token. sessionStorage (deleted when the browser tab is closed): — passkey-banner-dismissed — hides the passkey suggestion bar. — skillpass-auth-theme — the theme on auth.skillpass.id pages. d) Statistics, analytics and marketing cookies: we do not use any. Should we introduce them in the future, only with your prior consent (GDPR Art. 6(1)(a)).

3. Consent

No prior consent is required for strictly necessary cookies — they are essential for service functionality. If we introduce analytics or marketing cookies in the future, we will notify you in advance and request your permission.

4. How to Manage Cookies

— Browser settings: you can view and delete cookies and browser storage in your browser at any time. After deleting the strictly necessary cookies you will need to sign in again. — Cookie notice: your choice is stored under the skillpass-cookie-consent key; since we only use necessary and preference storage, the service is fully available after choosing “Necessary only”. — On sign-out the session cookies and the sp_theme cookie are deleted.

5. Data Security

— HttpOnly: the session, CSRF and invite-code cookies cannot be read from JavaScript (XSS protection). — Secure: cookies are only sent over HTTPS connections. — SameSite: cookies are not sent with requests initiated by third-party sites, or only on top-level navigation.

6. Third Parties

Every cookie and storage key listed is set by SkillPass.ID’s own domains (skillpass.id, auth.skillpass.id). We do not use third-party cookies (e.g. Google Analytics, Facebook Pixel).