Cookie and Local Storage Statement
Which cookies and browser storage LeraLink uses, and why
Last updated: 12 November 2026
1. Scope
This statement covers LeraLink's own sites and the installations LeraLink hosts. It lists what the platform itself sets. An installation that adds its own measurement or embedded services must describe them in its own notice. The Dutch Telecommunications Act and the GDPR apply according to the technology and the processing involved.
2. Cookies
Reading public pages sets no cookie. A cookie is set only when you sign in or choose a language.
| Cookie | Purpose | Lifetime | Kind |
|---|---|---|---|
| \_\_Host-lera-audience-session | keeps you signed in as a reader or member of an installation | ends after 30 days without use, and at most after 90 days | strictly necessary |
| \_\_Host-lera-studio-session | keeps an author signed in to the Studio | ends after 30 days without use, and at most after 90 days | strictly necessary |
| \_\_Host-lera-tenant-admin-session | keeps an installation's administrator signed in | with an email code: 30 days without use, at most 90 days; with a passkey: one hour without use, at most 12 hours | strictly necessary |
| \_\_Host-lera-superadmin-session | keeps a platform administrator signed in | with an email code: 7 days without use, at most 30 days; with a passkey: 15 minutes without use, at most 8 hours | strictly necessary |
| lera_pls_locale | remembers the interface language you chose | one year | functional, set at your request |
| lera_kls_language | remembers the content language you chose | one year | functional, set at your request |
The four session cookies hold only a random token; our server keeps a hash of it, never the token itself. They are sent only over encrypted connections, cannot be read by scripts on the page (HttpOnly), are not sent with requests started by other sites except when you follow a link (SameSite=Lax), and belong to the exact address that set them: the \_\_Host- prefix forbids sharing them with other subdomains. Signing out deletes the cookie and ends the session on the server.
The two language cookies contain only a language code.
Cloudflare, which delivers our sites, can set a security cookie (such as \_\_cf_bm) when its bot protection is switched on for a site. It is not switched on for LeraLink's own sites. If we switch it on, it is a strictly necessary security cookie and we will list it here.
We use no advertising or cross-site tracking cookies.
3. Browser storage
The interface keeps small items in your browser's local storage or session storage. They stay on your device. Our servers do not read them; the page sends only what an action you take needs.
- ●Display: light or dark appearance and colour palette, interface and content language, list or grid view, text size in parallel reading, notices you have closed, and whether you allow content from other services (section 5).
- ●Reading: where you are in a book or project, which works you have finished, where you stopped in an audio recording, your recent searches, and, for the current tab only, scroll position while you browse.
- ●Writing (signed-in authors): unsaved drafts of blocks and translations, so that closing a tab does not lose work; the layout of the Studio; an import you can resume.
- ●Technical: a marker that reloads the page once after an update, for the current tab only.
Session storage is cleared when you close the tab. Local storage stays until you clear it in your browser. Clearing it resets your preferences and can delete unsaved drafts. On a shared computer, sign out and clear the site's data when you finish.
We use this storage only for a function you are using; none of it serves measurement or advertising.
4. Measurement
LeraLink's own sites load no analytics script. Our servers count reading anonymously, without cookies, stored identifiers or IP addresses (see section 2 of the Privacy Statement). An installation may switch on Cloudflare Web Analytics for its public pages: it loads a script from Cloudflare, sets no cookie and uses no browser storage. We do not use Google Analytics.
5. Content from other services
Some works include content from other services: a video from YouTube (through its privacy-enhanced address, youtube-nocookie.com) or Vimeo, a post from X, or an audio or video file held elsewhere. Such content is not loaded until you allow it. In its place you see a box naming the service; the first time a page has such content, a notice also asks once. If you allow it, content from other services is shown on every page from then on, and your choice is kept in your browser's storage on this device (see section 3). You can also show a single item without changing your choice, or answer "Not now" and keep the boxes. Only when content is shown does your browser connect to that service, which then receives your IP address and your browser's details and may set its own cookies or storage under its own policy. You can change your choice at any time under Cookie settings at the foot of every page; turning it off removes that content from the page at once. Cookies those services have already set stay in your browser until you delete them. An audio or video file held elsewhere plays in our own player, which connects to the site holding the file when you play it.
6. Your choices and contact
Your browser can block or delete cookies and storage. Blocking the session cookies prevents signing in, not reading public pages. For your rights and the recipients of personal data, see the Privacy Statement. Contact: privacy@lera.link.