Cookie Policy & Data Retention

Last updated: 2026-10-17

This page explains the cookies Your Field ("we", "us") uses and how long we keep the data we collect. It supplements our Privacy Policy.

1. What cookies are

Cookies are small text files a website stores in your browser. We use them to operate the Service and, through Google Analytics, to measure how it is used. We do not use advertising or cross‑site tracking cookies.

2. Cookies we use

• cs_consumer: Strictly necessary. Keeps you signed in to your parent account after you sign in. Signed and http‑only (not readable by page scripts). Duration: 30 days.
• cs_staff: Strictly necessary. Keeps a Your Field staff member signed in to the private admin area after single sign‑on, including which admin functions they may use. http‑only; set only for staff. Duration: 12 hours. (Earlier password‑based admin cookies, cs_admin and cs_stats, are no longer set; sign‑in is single sign‑on only.)
• cs_oidc: Strictly necessary. Protects the sign‑in handshake for a few minutes while you are redirected to our sign‑in service and back (it prevents forged sign‑in attempts). http‑only, single‑use. Duration: 10 minutes.
• cs_preview: Functional. Set only when you open a preview link shared by the Your Field team; it pins your browser to that preview version of the site so everyone with the link sees the same thing. http‑only, carries no personal data. Duration: 7 days (or until you open the release link).
• cs_ab: Functional. A random identifier (no name, email, or profile) that keeps the version of a page you see consistent while we test improvements, so the site does not change appearance between visits mid‑test. http‑only; set only while an improvement test is actually running; when none is, no identifier is issued. Duration: 1 year.
• cs_src: Functional. Set only when you arrive with campaign parameters in the address (utm_source, utm_medium, utm_campaign) or from another site, and only if it is not already set; it holds those values (or the referring site's name) and nothing else (no identifier), so that if you later create an account, we can count where the sign‑up came from. A plain visit sets no such cookie. Readable by our sign‑in service only at sign‑in. Duration: 30 days.
• _ga, _ga_<container‑id>: Analytics. Set by Google Analytics (see "Other technologies" below) to distinguish visitors and measure how the site is used in aggregate. Not readable by our servers directly, and not used for advertising. Duration: up to 2 years.

We previously used a short‑lived guest "meter" cookie for the results gate; it has been removed. The current gate is computed per request and stores nothing in your browser.

The cookies marked strictly necessary provide features you request (such as staying signed in) and do not require consent under typical rules. The functional and analytics cookies are not required to use the site: you can block or delete them in your browser settings, and analytics can be opted out of with Google's browser add‑on. If you sign out, the cs_consumer cookie is cleared. Signing in will not work without cs_consumer.

Browser storage (not cookies). The site also keeps a few small items in your browser's own storage, on your device only, never sent to us as such: whether you dismissed the cookie notice (cs_cookie_notice_ack), the listings and plan items you saved while not signed in (csny.saved, csny.calc), your activity‑finder preferences and the facts you told it during a visit (classscout.scout.prefs.v1, classscout.scout.sessionFacts.v1), a device location you chose to share (classscout.parentLocation.v1, for that browsing session), and whether you have seen the first‑visit tour (classscout:onboarding-tour:v1:seen). Clearing your browser's site data removes all of them.

3. Other technologies

• Analytics. We use Google Analytics, a usage‑analytics tool, to understand how visitors navigate the site in aggregate (which pages are viewed, how people move between them) so we can improve it, including measuring the effect of the improvement tests noted above. It is not an advertising or retargeting tool. We do not enable ad personalization or cross‑site advertising features, and we do not send it your name or email. See Google's Privacy Policy for how Google itself handles this data. We do not embed any other third‑party advertising or analytics trackers.
• Server logs. Our hosting provider (Vercel) may keep standard request logs (such as IP address and timing) for security and reliability.
• Map tiles. When you view a map, your browser requests map tiles directly from the tile provider (OpenStreetMap, or optionally Google). Those requests are subject to the provider's own policies.

4. Data retention schedule

We keep information only as long as needed for the purpose it was collected:

• Product / gate telemetry (coarse, non‑identifying events): auto‑deleted after 90 days (database TTL index).
• Scout AI telemetry (coarse intent dimensions; no query text while the optional query log stays off, which it is): auto‑deleted after 90 days (database TTL index).
• Survey answers (anonymous one‑question feedback; never linked to an account): auto‑deleted after 12 months (database TTL index).
• Parent account (display name, account identifier, preferences, saved listings, activity plan, first‑seen / last‑seen / sign‑in count): kept while the account is active; deleted on request.
• Personalized‑recommendations activity (opt‑in only): kept while the account exists; deleted on request or with the account.
• Claim, update, and featured-placement requests (submitted name, email, role, phone, business website, business registration number, proof link, and request text): kept while under review and for 12 months after the decision, then deleted automatically (database TTL index). Claim evidence/contact fields are optional; a provided business registration number is encrypted at rest and available only to authorized staff reviewing the claim.
• Improvement‑test records (one‑way hash of the cs_ab identifier and the page version it was shown): auto‑deleted after 180 days (database TTL index).
• Session cookies: as stated in the cookie list above.
• Catalog / listing data (about providers, not about you): kept while the listing is active; refreshed on a rolling basis.
• Google‑sourced business fields: kept with a provenance timestamp and refreshed periodically; restricted to the non‑personal fields described in the Privacy Policy.

To request access to, export of, or deletion of your account data, email info@classscout.ai. Signing out ends your session on that device immediately.

5. Contact

Your Field: info@classscout.ai