Last updated 17 October 2026
This site (the public pages you’re reading) sets no cookies at all, unless you ask it not to count your visits (below). The app sets what’s needed to keep you signed in, and nothing else. We use no advertising cookies, no social media pixels, and no third-party analytics, which is why there’s no cookie banner here.
The cookies.
| Name | Set by | Type | Purpose | Lifetime |
|---|---|---|---|---|
__Secure-better-auth.session_token | api.bridgeunlocked.com | Strictly necessary, HttpOnly | Keeps you signed in across the app and this site | 30 days, rolling |
bu_signedin | the API at sign-in | Strictly necessary, readable by pages | Lets this site show "Continue learning" instead of "Start for free", and the right download lines on the Handouts page, when you're signed in. Contains only the value 1, never anything about you | 30 days, cleared at sign-out |
__Secure-better-auth.state | api.bridgeunlocked.com | Strictly necessary, HttpOnly | Only while you sign in with Google: checks that the answer coming back from Google belongs to the sign-in you started | 5 minutes |
__Secure-better-auth.two_factor | api.bridgeunlocked.com | Strictly necessary, HttpOnly | Only for accounts with two-step sign-in, which the app offers to staff: holds a password sign-in open while the six-digit code is entered | 10 minutes, or until the code is entered |
bu_no_count | this site, only if you choose it below | Strictly necessary to keep your choice, readable by pages | Remembers that you asked us not to count your visits, on this site and in the app. Contains only the value 1 | 1 year, or until you ask to be counted again |
What the app keeps in your browser.
A cookie is not the only way a site remembers something. The app also uses your browser’s own storage, which never travels to us the way a cookie does: it sits on your device and the app reads it back. Most of it exists so the app keeps working when your connection does not, and so it stops asking you the same question twice.
Kept in your browser until you sign out or clear it.
| Key | What it holds | How long |
|---|---|---|
bridgeunlocked.progress.<account> | Your own copy of your progress, so lessons keep working when the connection drops | Until sign-out or you clear your browser |
bridgeunlocked.progress | Your progress from the earlier test version of the app, if this browser still has it. The app reads it only to offer to bring it into your account, and never writes it | Left by the earlier version; removed if you delete your account here, or when you clear your browser |
bu.progress.version.<account>, bu.progress.dirty.<account> | Two small markers that tell the app whether your latest work has reached our server yet | Until sign-out |
bu.answers.queue.<account> | Answers you have given in quizzes, topic tests and Your Call that have not reached our server yet, for example while you are offline | Until they reach our server, usually straight away, or until sign-out |
bu.docFields.<account> | Your saved items, the milestones you have celebrated, the one-time cards you have seen and the badges you have seen | Until sign-out |
bridgeunlocked.entitlements | A copy of what your plan unlocks, so the app does not flash locked content while it checks | Until sign-out |
bu.lastUser | Which account signed in last on this device, so two people sharing a device never mix records | Until you clear your browser |
bu.imported.<account> | That we already asked you about importing older progress, so we never ask twice | Until you clear your browser |
bu.ack.<surface>.<account> | That you answered a one-time notice, so it does not reappear on every screen | Until the notice is genuinely new again |
bu.tourAndTrialPrompt.<account> | How far you got through the one-time tour and the free-trial offer | Until sign-out |
bu.dealCaptionSeen.<account> | That you have seen the caption explaining your first deal. Before you have an account the word guest stands in for the account | Until you clear your browser |
bu.welcome.method | Whether you last signed in with an email link or a password, so the sign-in screen opens the same way | Until you clear your browser |
bu.pending_news_opt_in | Remembers for up to an hour that you ticked the newsletter box while signing in or creating your account, with a scrambled form of the address you typed (never the address itself), so it is recorded only for that address | Removed once used, and ignored after one hour |
bu.betaEndSeen.<account> | That you dismissed the notice about the free launch period ending | Until the date on that notice changes |
bu.admin.welcomed | That the admin welcome card was dismissed. Only ever written on our own staff screens | Until you clear your browser |
bu-admin-newsletter-test-addresses | Up to five addresses our staff send test newsletters to. Only ever written on our own staff screens | Until you clear your browser |
Gone when you close the tab.
| Key | What it holds | How long |
|---|---|---|
bu.anon_id | A random id that lets us count how the app is used before you sign in. If you create an account in this tab, it links what you tried to your new account. It is removed when you sign in, none is made if you have asked us not to count your visits, and it is in nobody else’s hands | This tab only |
bu.guestProgress | What you do without an account (lessons, the Bridge Basics Test, Your First Hand, practice and the badges you have seen), the system you chose, your sound setting and your text size, so you can carry on in this tab. It holds no name, email or id. It leaves your browser only when you save it to an account. If you ask for a sign-in link from this page, it goes with that request, and we keep it until you open a link sent to that address, or for a day at most, then delete it | This tab only |
bu.guestCompanion | Before you have an account: whether Bridget's notes are on, quieter or off, and which of her notes you have seen or closed, so she does not repeat herself. It moves to your account when you save your progress | This tab only |
bu.dealCaptionSeen.guest | Before you have an account: that you have seen the caption explaining your first deal | This tab only |
bu.postCheckoutReturnTo | The page you were on when you started a payment, so we can put you back there | This tab only |
bu.pendingToasts | A message the app owes you across a page change, such as a confirmation | This tab only |
bu.badge_notes_waiting | A badge note still waiting to be shown, kept so a reload does not lose it, and removed as soon as the note appears | This tab only |
bu.skew_reload_at | The moment of the last automatic reload, so a new release can never put you in a reload loop | This tab only |
bu.recoveryCodeUsed | That you just signed in with a recovery code, so the next screen can tell you to make a new one | This tab only |
bu.handInProgress.<surface>.<account> | The hand you are playing, or your place between hands in Practice, so reloading the page puts you back at the same point instead of dealing again. Before you have an account the word guest stands in for the account | This tab only, removed when you leave the table |
bridge.admin.membersSearch | The last search on our staff members list, so going back finds it again. Only ever written on our own staff screens | This tab only |
bu.signup_attribution | If you followed a link with a code from a teacher or club, or a link that says where it came from (for example a newsletter), that code and where you came from, so they can be kept with your account when you sign up. Used on this website and in the app | This tab only, and in the app it is cleared when you sign up |
bu.mark_drawn | That the mark at the top of this website has already drawn itself once, so it does not redraw on every page | This tab only |
If you sign out, the app clears the keys tied to your account. Clearing your browser’s site data clears all of it, and nothing is lost that we do not already hold on our side for you, except what you have done without an account and not yet saved.
What we don’t use.
No advertising cookies. No social media pixels. No third-party analytics, no Google Analytics, no Facebook pixel, no embedded players or fonts that would let anyone else watch you read. Our fonts are served from our own server.
Our own measurement is first-party and deliberately small. On this website
it uses no cookie and stores nothing on your device: our server counts a
visit under a code worked out from your connection and a secret that
changes every day and is never saved, so visitors cannot be followed from
one day to the next. If your browser sends a Global Privacy Control or Do
Not Track signal, this website does not count your visit at all. In the
app, before you sign in, it uses a random id kept only while the tab is
open (bu.anon_id above); if you create an account or sign in in that tab,
we link that id to your account, so the steps you took just before count as
yours. Once you are signed in it uses your account and keeps no id of its
own in your browser.
If you would rather not be counted, say so here. It works on this site and in the app. In the app, what you do while signed in is still kept with your account, because that is how it keeps your progress, your weekly summary and your reminders.
Email works differently. Our email is sent by Amazon Web Services, through its Amazon SES service in its Europe (Ireland) region. Our emails carry no tracking image, and Amazon does not redirect our links or count clicks. Our own systems do not keep a record of whether you opened an email. We keep a record of the links you click only in our emails with an Unsubscribe link at the bottom, such as the newsletter: a link you click there passes through our own server so that we can count the click. When such a link opens the app, the page it opens notes which email brought you there; nothing about it is kept in your browser. Before launch day our email was sent by Brevo, which adds a tracking image and its own link addresses; the privacy notice says more.
When you pay for Plus, you do so on Stripe’s own checkout page. Stripe uses its own cookies there to take the payment safely and to prevent fraud. Those cookies are Stripe’s, not ours, and Stripe’s cookie policy explains them.
The legal bit, plainly.
The signed-in cookies above are strictly necessary. Without them you cannot stay signed in, so you cannot turn them off and still use your account, and they need no consent.
The browser storage above divides in two. Most of it is what makes the service you asked for actually work: your progress, your saved items, your place in a payment, the answer you already gave to a question. The rest rests on our legitimate interest in showing a service notice once rather than nagging; those keys identify nothing and track nothing. None of it reaches anyone else and none of it follows you to other websites.
The one exception is bu.anon_id, the app’s analytics id. It is not needed
to run the service, so we keep it as small as we can: it lives only as long
as the tab is open, it is never written once you are signed in, and it is
never passed to anyone else. If your browser sends a Global Privacy Control
or Do Not Track signal, or you have asked us not to count your visits, the
app does not create it.
One more key is set only when a link carries it: bu.signup_attribution.
It holds a code from a teacher or club, and the source of the link you
followed (for example a newsletter), for this tab only, so they can be kept
with your account if you sign up. If you do not sign up, nothing in it
reaches us.
Progress you make without an account is kept for the page you are using, which the lessons need in order to work, so it needs no consent.
Is there a cookie banner?
Not on this build, and we checked rather than assumed. A banner exists to collect consent. On this site there is nothing to consent to: no cookie is set unless you ask us not to count your visits, nothing that identifies you is stored on your device, and the one measurement we run cannot follow you from one day to the next. Asking for permission we do not need would be theatre, and would train you to click through the ones that matter.
If we ever add cookies or storage beyond what is on this page, this page and the privacy notice change first, and we’ll ask for consent where the law requires it.
