Cookie Policy
Last updated: 2026-07-08
This Cookie Policy explains how Linuxlab ("Linuxlab," "we," "us," or "our") uses cookies and similar browser storage on Linuxlab.io and its related subdomains (together, the "Site"). It also tells you exactly which cookies we set, why, how long they last, and how you can control them.
This document is written to match what the Site actually does. Linuxlab uses only the small number of cookies it needs to work. There are no advertising cookies, no marketing pixels, and no third-party tracking cookies of any kind. Our usage analytics do not use cookies at all.
This is an informational notice, not a consent form. Read section 8 for why we do not show a cookie consent banner.
1. What cookies are
Cookies are small text files that a website stores in your browser. When you return to the site, your browser sends the cookie back, which lets the site recognize your session and remember choices such as your language.
We also use two related technologies that are not cookies but that some people think of as "cookies":
- Local storage ("localStorage") is a small store inside your browser that a site can read and write. Unlike a cookie, it is never automatically sent to a server. We use it to remember a few preferences on your device.
- Server-side session storage holds short-lived data on our own servers, not in your browser. We use it for the interactive sandbox. It is not a cookie and nothing about it is stored on your device.
We describe all three below so you have the full picture.
2. Summary of what we use
- Three cookies, all first-party, all strictly necessary. No analytics cookie, no advertising cookie, no tracking cookie.
- A few localStorage keys on your device for functional preferences, such as your light or dark theme.
- Usage analytics that do not use cookies at all. They are first-party only, store no raw IP address, and honor the Do Not Track and Global Privacy Control browser signals.
- No third-party advertising or analytics services run on the Site. There is no Google Analytics, no Meta pixel, and no similar tool.
3. The cookies we set
All three cookies below are first-party (set by Linuxlab, not by an outside company) and strictly necessary for the features you ask for. You cannot turn them off within the Site and still use the feature they support, because they are the feature. You can still remove or block them through your browser (see section 7), with the effects noted.
| Cookie | Type | Purpose | Flags | Duration | How to control it |
|---|---|---|---|---|---|
ll_session | Strictly necessary — authentication | Keeps you signed in. Its value is your opaque session token, which is a secret. Without it you cannot stay logged in. | HttpOnly; Secure (on staging and production over HTTPS); SameSite=Lax; Path=/ | 14 days (1,209,600 seconds), sliding — it refreshes while you stay active. Cleared when you log out. | Sign out to clear it, or delete cookies in your browser. Removing it signs you out. |
ll_locale | Strictly necessary — language preference | Remembers whether you chose Russian or English. Holds no personal data and no secret. | Not HttpOnly (the language switcher reads it); Secure over HTTPS; SameSite=Lax; Path=/ | 365 days (31,536,000 seconds) | Delete cookies in your browser. The Site will fall back to detecting your language again. |
ll_locale_src | Strictly necessary — language preference | Records whether your language was set by an explicit choice or by an automatic guess, so an automatic guess never overrides a choice you made on purpose. Holds no personal data and no secret. | Not HttpOnly; Secure over HTTPS; SameSite=Lax; Path=/ | 365 days (31,536,000 seconds) | Delete cookies in your browser. |
We do not set any other cookies. In particular:
- There is no advertising, analytics, or tracking cookie of any kind.
- There is no separate CSRF cookie. We protect form submissions with a stateless origin check and signed request nonces, not a cookie.
- The interactive sandbox sets no cookies. It authenticates each connection with a single-use ticket in the connection URL, not with your session cookie.
4. Browser storage on your device (not cookies)
The following items live in your browser's localStorage. They stay on your device, are never sent to our servers automatically, and hold no advertising or tracking data. You can clear them at any time through your browser's site-data controls.
| Key | What it stores | Why |
|---|---|---|
ll_theme | light or dark | Remembers your chosen display theme. |
ll_vid | A random visitor id used by our cookie-free usage analytics | Lets us count unique visits without a cookie and without your identity. It is suppressed and sent as empty when your browser signals Do Not Track or Global Privacy Control. See section 5. |
ll_cookie_notice | accepted | Remembers that you dismissed the one-time cookie notice, so we do not show it again. This is why the notice needs no consent: the dismissal itself is a local preference, not a cookie. |
ll:lesson-done:<lesson> | 1 per finished practice lesson | A per-browser hint of which hands-on lessons you have completed. |
5. Analytics (cookie-free, and it honors your privacy signals)
We measure aggregate usage of the Site so we can improve it. Our analytics are unusual in a good way:
- They do not use cookies. The optional visitor id lives in localStorage (
ll_vid), not in a cookie. - They store no raw IP address. Where a visitor identifier is needed and no
ll_videxists, the server derives it by one-way hashing of connection details. The raw IP address is used only as an input to that hash and is never stored. - They are first-party only. No data is shared with an outside advertising or analytics company. There is no Google Analytics, Meta pixel, or comparable third-party tool on the Site.
- They honor Do Not Track and Global Privacy Control. If your browser sends the Do Not Track signal or the Global Privacy Control signal, we drop the visitor identifier entirely. The recorded page view is fully de-identified — no account link, no visitor key, no per-visitor counter.
- They strip sensitive parts of the URL. Query strings and page fragments are removed before storage, and any referring site is recorded as a bare host, never a full address.
If you are signed in and your browser does not send a Do Not Track or Global Privacy Control signal, a page view may be linked to your account for product analytics. Under Do Not Track or Global Privacy Control, that link is not made.
6. Third-party embeds (video and terminal casts)
Some lessons embed video or recorded terminal sessions. We use privacy-forward embed sources on purpose:
- YouTube in "no-cookie" mode (
youtube-nocookie.com). This mode defers setting any cookie until you actively press play on a video. If you never play the video, it sets no cookie. - asciinema for recorded terminal casts.
When you play an embedded video or cast, the embed provider may set its own cookies under its own policy, which we do not control. If you do not interact with an embed, these providers set nothing.
These conditional, playback-only embeds are the only third-party sources that can set cookies through the Site, and only when you actively play the media. Their handling of any data is governed by their own policies: YouTube and asciinema.
Aside from these interaction-gated embeds, no third party sets cookies through the Site.
7. How to control cookies
You are always in control of cookies at the browser level.
- Sign out to clear your
ll_sessionauthentication cookie immediately. - Delete cookies and site data for Linuxlab.io in your browser settings to remove all three cookies and the localStorage items in section 4.
- Block cookies for the Site in your browser. Note the effect: blocking the strictly necessary cookies in section 3 will stop you from staying signed in and will stop the Site from remembering your language. The rest of the Site still works.
- Turn on Do Not Track or Global Privacy Control in your browser to have our analytics fully de-identify your page views (see section 5).
Browser instructions:
On mobile, you can manage cookies and site data in your browser app's settings, and clear website data in your device's browser or Safari settings.
Because we set no advertising or tracking cookies, there is no ad-network opt-out to perform and no "Do Not Sell or Share" link to click. We do not sell or share your personal information.
8. Why we show a notice, not a consent banner
We show a short, one-time informational notice, not an interactive consent banner. This is deliberate and, we believe, correct:
- The only cookies we set are strictly necessary ones — your sign-in session and your language choice. These are the kind of cookies that keep the service working and reflect a choice you made, so they do not require prior consent.
- Our usage analytics do not use cookies at all, store no raw IP address, and honor Do Not Track and Global Privacy Control.
- We run no advertising, marketing, or third-party tracking cookies, and we do not sell or share personal information.
Because there is nothing that requires opt-in consent, a granular accept/reject banner would be theater. The notice simply tells you what is happening and links here.
9. Changes to this policy
We may update this Cookie Policy from time to time, for example if we add a feature that changes which cookies we use. When we make a material change, we will update the "Last updated" date at the top and, where appropriate, note the change on the Site. Continued use of the Site after an update means you have seen the current version. We encourage you to review this page periodically.
10. Contact
If you have questions about this Cookie Policy or how we use cookies:
- Signed-in users can reach us through the feedback form inside your account ("Write from your account").
- Linuxlab is operated by Automation and Progress LLC.
For how we handle personal data more broadly, see our Privacy Policy. This Cookie Policy is part of, and should be read together with, that Privacy Policy.