Cookie policy

§1What cookies are

A cookie is a small data file the browser stores on your device when you visit a site. Cookies let a site remember preferences and keep you signed in across page loads. We treat browser localStorage and sessionStorage as the same category for the purpose of this policy.

§2What Pinaka sets

All cookies Pinaka sets are first-party (the mypinaka.com domain and its subdomains). They are categorised as strictly necessary. You cannot opt out of strictly-necessary cookies because the service does not work without them.

1. Authentication cookie (Amazon Cognito ID and refresh tokens): keeps you signed in. Secure, HTTP-only, SameSite=Lax. Cleared on sign-out or when the session expires (refresh window is thirty days).
2. CSRF protection token: protects form submissions against cross-site request forgery. Per-session.
3. Theme and accessibility preference: remembers light or dark mode and reduced-motion preference. Stored in browser localStorage. Persists until you clear it.
4. Consent record (pinaka:consent in localStorage, when applicable): stores your cookie-consent choice in jurisdictions that require an explicit opt-in. Persists for twelve months.
5. Marketing attribution (pinaka:attribution in localStorage, pinaka:attribution:pending in sessionStorage): records the UTM parameters or referrer that brought you to the site, so a later signup can be attributed to the originating campaign. No name, email, or address; UTM and referrer values only. localStorage persists until you clear it; sessionStorage clears when the tab closes.
6. Session identifiers (pinaka:session_id and pinaka:track:sid in sessionStorage): random per-tab IDs used to group product events into a single session for aggregate analytics. Clears when the tab closes.

§3Operational telemetry

Pinaka uses a one-pixel image served from the mypinaka.com parent domain to count page views and key product events. The marketing site fires it same-origin; the student and admin apps fire it cross-subdomain to the same Pinaka-controlled endpoint, never to a third party. The pixel request goes to Amazon CloudFront, which records the request URL, timestamp, user agent, and the client IP address in an access log. The access log is retained for ninety days and is used only to debug outages, detect abuse, and compute aggregate product analytics. No third-party script, no advertising network, no cross-site identifier.

A first-party cookie named pinaka_vid is set on the .mypinaka.com parent domain to give each visitor a stable random identifier across the marketing site and the app. This lets us measure, in aggregate, whether a marketing visit led to a signup. The cookie holds a random value with no name, email, or IP. It is valid for thirteen months and you can clear it from your browser at any time.

§4What Pinaka does not set

No advertising cookies. No third-party analytics that resell behavior across sites. No social-media share pixels. No fingerprinting libraries. No cookies that personalise content on the basis of inferred demographics or interests.

§5Managing cookies

You can clear or block cookies in your browser settings at any time. Strictly-necessary cookies are required for the service; clearing them will sign you out and reset your preferences.

Where the law of your jurisdiction requires opt-in consent for non-essential cookies (for example the EU ePrivacy Directive, the UK's PECR, or Quebec's Law 25), we honour that requirement at the point of first visit. The analytics pixel and the pinaka_vid cookie remain off until you click Accept on the consent banner. The marketing site detects whether you are in one of those jurisdictions by looking up your IP country on the server; the lookup result is used only to decide what fires before you choose, and the IP itself is never stored or returned to the browser.

You can change a previously-recorded consent decision at any time from the Cookie preferences link in the footer. Clicking it clears the stored decision and re-opens the same banner you saw on first visit.

§6Changes to this policy

We may update this policy when cookies are added or removed. The "Last updated" date at the top of the page reflects the latest revision.

§7Governing law

This policy is governed by the laws of the Republic of India. Cookie-consent rules for users in jurisdictions that require explicit opt-in (such as the European Union and the United Kingdom) are honoured where applicable.