Cookie and browser-storage policy

About this demonstration policy

Lagoon Heights Academy is a fictional demonstration school. This policy illustrates a complete school process as at 8 October 2026; it is not an approved policy of an operating school or a claim of legal certification. The sample email, telephone and address are not monitored services. Do not submit real children’s information, send money or rely on this demo for urgent help. A live school must approve its own details and procedures before using this copy.

What is used on this website

Cookies are small browser records; local storage is another way a website remembers information on your device. This website currently has no Google Analytics, Meta Pixel, advertising cookies or cross-site marketing tracker. The public site can be browsed with optional analytics and marketing declined. Essential security and your requested preferences are described below. Optional categories start off; choosing a category does not install a tracker that is absent from this release.

Essential school storage

These items support the service you request. The sign-in cookie contains an opaque identifier, not names, grades, health notes, bank details or raw identity-provider tokens. The school uses it to check the current server session and permissions. Blocking all cookies can prevent account sign-in; it is not necessary to sign in just to read public policy pages.

• oyibo_session: an HttpOnly school-session cookie, lasting up to eight hours. Sign-out removes the browser cookie and revokes that session on the server; administrators can revoke access sooner.
• oyibo_oidc: a short sign-in state cookie scoped to the authentication flow, lasting up to ten minutes and cleared after callback. It helps prevent a fraudulent sign-in redirect.
• Cookie-choice storage: oyibo-school-site-preferences followed by the school identifier is local browser storage. It remembers essential-only preferences for 180 days, including the policy version; analytics and marketing are recorded as off. It is not an advertising profile.
• Application-payment link: the payment page keeps the private link token in session storage for the current browser tab so a hosted-checkout return can resume the fee view. The server still checks the link’s expiry. Treat the link as confidential: do not share it with another family, and close the tab on a shared device.
• Private attendance drafts: a teacher can recover an unsaved local draft within eight hours. It is scoped to the school/user/role and cleared on sign-out or when an expired draft is checked. Clearing browser storage also removes it; it is not public-site analytics.

Your optional choices

The banner offers Essential only and a Manage cookies panel. Analytics and advertising are shown as Not used because no optional trackers are installed; the current panel does not ask you to accept an unused service. You can use the website without enabling optional tracking. Open Cookie settings again from the website footer to review the choice. Clearing browser storage removes the saved choice, so the banner may ask again; a changed policy version also renews the notice. An operating school must update this notice and obtain a separate, reversible choice before adding optional tools. Scrolling, silence or an enquiry submission is not permission for marketing tracking.

Provider-domain cookies

If you choose to sign in through Amazon Cognito, its managed-login pages use their own security/session cookies; AWS describes an approximately one-hour managed-login session plus request-state and language cookies. The school’s eight-hour server session is a separate item. If you choose to pay through Paystack, its hosted checkout and related services have their own privacy and cookie practices. The school’s cookie button does not control cookies on those separate provider domains. Read the provider notice and use its controls there.

• Amazon Cognito documentation: docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html
• Paystack Privacy and Cookie Policy: paystack.com/terms

Hosting and your browser controls

Render and PostgreSQL process requests on the server; private R2 storage supplies authorised documents. They are not advertising scripts installed on this public page. Providers may keep service/security records under their agreements. Browser settings let you inspect or clear cookies and local storage, restrict third-party cookies, or use a private window. Clearing sign-in storage may sign you out and clearing a local draft may remove unsaved work. For a storage concern, describe the page and browser to the school without sending a password or session token.