sessionid
First-party session cookie. It keeps an authenticated user signed in. Strictly necessary. Default duration is up to 12 hours and it normally ends when the browser closes.
csrftoken
First-party security cookie used to prevent forged form submissions. Strictly necessary. Django controls its duration.
cq_consent
First-party signed cookie that remembers preferences and the consent configuration version. Strictly necessary to remember a reject or accept choice. It lasts for the configured consent period.
Meta Pixel
If an eligible visitor accepts Marketing and META_PIXEL_ID is configured, CodeQuest loads the Meta Pixel from connect.facebook.net. It measures page visits and eligible adult or teacher registrations for advertising measurement and campaign optimisation. Student accounts cannot enable it, and no lesson, achievement, curriculum or class activity is sent. Information and request metadata may be sent to Meta. Meta may set first-party identifiers such as _fbp or _fbc. No unconditional tracking image is used.
Browser storage
The application does not use localStorage, sessionStorage, IndexedDB or a service worker for Meta tracking. Pyodide code runs in a browser worker and is delivered from jsDelivr when a coding activity is opened.
Changing choices
Use Cookie choices in the footer at any time to withdraw Marketing consent. Withdrawing stops the Pixel loading on later pages and CodeQuest removes first-party Meta cookies where technically possible. Rejecting optional categories does not prevent core learning, login or security features.