Cookies and storage

Cookies are small text files stored on your device when you visit a website. They let us recognise you, save your preferences, and provide the service. Besides cookies, we also use the browser’s local storage (localStorage) for settings that stay exclusively on your device.

These cookies are strictly required for the app to operate. Without them, sign-in and session management do not work. They cannot be declined.

• pokyh_sessionNecessaryEncrypted WebUntis session token (AES-GCM, httpOnly). Contains no personal data in plaintext. Expires after 4 hours.
• pokyh_userNecessaryNon-sensitive display information (username, class). No password, no session token. Expires after 4 hours, after 8 hours with a POKYH account without a school account.
• pokyh_api_tokenNecessaryAccess token (JWT) for the POKYH backend. Expires after 8 hours.
• pokyh_api_refreshNecessaryRefresh token to renew the access token automatically (httpOnly). Expires after 30 days.
• pokyh_renewNecessaryEncrypted credentials and chosen school (AES-GCM, httpOnly), so a session WebUntis ended can be renewed automatically. Only sent to the sign-in address, only valid together with the session, deleted when you sign out. Expires after 4 hours.
• passkey_declinedNecessaryRemembers that you declined saving the sign-in in the browser. Expires after 1 year.

These cookies are only set if you choose “Accept all” . They help us improve the app by collecting anonymised usage data.

• _gaStatisticsGoogle Analytics 4: unique counter for site visits. Expires after 2 years. The IP address is anonymised before transmission.
• _ga_*StatisticsGoogle Analytics 4: session state and page counter. Expires after 2 years.

These entries are stored only locally in your browser (localStorage or sessionStorage) and never leave your device. They are not cookies in the legal sense but are listed here for completeness.

• pokyh_themeSettingSaved colour scheme (light/dark/system). No expiry.
• pokyh_sidebar_collapsedSettingSidebar collapsed or expanded state. No expiry.
• pokyh_cookie_consent_v2SettingYour cookie-banner choice (personal usage statistics yes/no, Google Analytics where offered) with its date and the account it applies to. After “Necessary only” we ask again no sooner than 6 months later. No expiry.
• pokyh_schoolSettingThe school chosen at sign-in (login name, name, address and server as listed by WebUntis). Expires on 31 August, not before 30 days.
• pokyh_external_mediaSettingRemembers that you hid the dish photos from other sites. Stays until you show them again on the cafeteria page.
• pokyh_localeSettingChosen language (cookie, 1 year).
• pokyh_privacy_ack_pendingNecessaryRemembers between the sign-in form and the sign-in that the privacy notice was shown to you; deleted afterwards.
• pokyh_cache_*NecessaryCache of recently loaded school data (timetable, grades, absences, messages) for faster display. Deleted when you sign out.
• pokyh_abscalc_*NecessaryCached calculation of absence hours.
• pokyh_grade_drafts_v1SettingGrade drafts you entered for the average calculation.
• pokyh_popups_seenSettingWhich notice popups you have already seen.
• pokyh_bell_seen_*SettingWhich of the bell’s notifications you have already seen and which you cleared (identifiers only, no content), per account, so the bell is right at once, offline too; kept in step with the copy at your account (see “Notifications (bell)”). Stays in the browser until you delete it there.
• pokyh_app_iconSettingChosen app icon.
• pokyh_mensa_choiceSettingThe canteen last chosen on the public canteen page, when there are several.
• pokyh_room_2bSettingProgress in the hidden classroom behind the door of the sign-in page (gold stars, collected items, records). Stays in the browser until you delete it there.
• pokyh_motion_notice_closedSettingRemembers for this tab that you closed the notice about “Reduce motion” (sessionStorage, until the tab is closed).
• pokyh_privacy_gate_openNecessaryKeeps the privacy notice open after signing in until you confirm it, also across a reload (sessionStorage, until the tab is closed).

You can change your choice at any time just as easily: open the cookie settings and turn off the personal usage statistics or Google Analytics, or choose “Necessary only”. The personal statistics can also be turned off in your profile.

Alternatively, you can permanently disable Google Analytics: Google Analytics opt-out

Necessary cookies are set on the basis of Art. 6(1)(b) GDPR (performance of a contract). The personal usage statistics and analytics cookies are based solely on your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

For questions about cookie use, contact:

[email protected]