Draft — not yet in force. Generation 3 Academy is not yet incorporated, so the operator, its registered address and its governing law are shown below as bracketed placeholders. This document has not been reviewed by a lawyer.
Until those brackets are filled in and a lawyer has read it, treat this as a statement of intent rather than a binding policy — and do not take money from families against it. Every open question is listed in the last section.
Cookie Policy
One cookie, set only when you sign in. No analytics, no advertising, no third-party trackers — and an explanation of why that means no consent banner.
The short version
Reading this site sets no cookies at all. The home page, About, Curriculum, The Vessels and these policy pages are static documents. You can read every one of them and we will not have stored anything in your browser.
Signing in sets exactly one cookie, called g3s. It is what keeps
you signed in. It carries a random session token and nothing else — no name, no
identifier, nothing readable.
There is no advertising cookie, no analytics cookie and no third-party cookie anywhere on this site, because there is no advertising, no analytics and no third-party script.
Browser storage we use
localStorage is not a cookie, but it stores data on your device, so the same
rules and the same honesty apply. The game keeps a student’s progress and preferences
there. None of it is ever sent anywhere except our own API, and none of it is used to track
anybody.
| Key | What it holds |
|---|---|
gen3_vessels_v1 | The saved game: flame, score, streak, progress, quests, reflections. |
gen3_vessels_save_… | A per-student copy of that save, so two children sharing a device do not overwrite each other. |
gen3_vessels_owner | Which account the save on this device belongs to. |
gen3_vessels_sound, gen3_vessels_rate, gen3_vessels_vidaudio | Sound on or off, narration speed, clip audio. Preferences only. |
gen3_portal_role, gen3_portal_name, gen3_portal_gender, gen3_portal_access | Signals so the portal can draw the right page without a round trip. Not credentials. |
gen3_portal_token | Used only when the API is on a different domain and the browser will not keep the cookie. Once the API moves to api.gen3academy.org this disappears entirely. |
g3_new_family_code | A freshly issued family code, held just long enough to show it to you once. |
All of it is strictly necessary for the platform to work, or a preference you set yourself. None is shared, and all of it disappears when you clear the site’s data.
If you install the app
The site can be added to a phone’s home screen. Doing that installs a service worker — a small script that keeps a copy of the pages, stylesheets, fonts and artwork in your browser’s Cache Storage, so the app opens quickly and shows a proper message instead of a browser error when you have no signal.
It never stores anything from your account. Pages under /portal/ and every
call to our API are excluded from it by name, and it ignores any request that is not a
simple page load — so a claim, a confirmation or a sign-in always goes to the
server and is never answered from a copy on the device.
This matters most on a shared family laptop: nothing one person saw can be served to the next person from the cache, because none of it was ever put there.
It holds no personal data, and like everything else here it is cleared when you clear the site’s data, or by uninstalling the app.
What we do not use
To be specific, because “we respect your privacy” means nothing on its own. This site contains none of the following:
No measurement
- Google Analytics, or any analytics
- Google Tag Manager
- Heatmaps or session recording
- A/B testing tools
No advertising or social
- Advertising or retargeting pixels
- Meta, TikTok or X pixels
- Social share or follow widgets
- Embedded YouTube or Vimeo players
This is enforced, not just promised. The site sends a Content Security Policy that permits scripts only from this origin, forbids the page being framed, and allows network calls to a short fixed list of hosts. Adding a tracker would not quietly work — the browser would block it.
The one script the site does install on your device is the service worker described in section 4. It is ours, it is served from this address, and it does no measurement of any kind.
Third-party requests
A page can leak an IP address without ever setting a cookie, simply by loading a file from somebody else’s server. So this list matters as much as the cookie table.
| Host | What for | When |
|---|---|---|
everyayah.com | Qur’an recitation audio | Only when a student presses play on a verse |
gen3-ai…workers.dev | Our own API and AI teacher | Signed-in use of the platform |
Until this date, every page loaded its typefaces from fonts.googleapis.com and
fonts.gstatic.com. That handed Google an IP address on every single page load
of a service used by children, and it happened before anyone signed in or agreed to
anything.
The typefaces are now served from this site. The public pages now make no third-party request at all, and the Content Security Policy has been tightened so that reintroducing one would break visibly instead of working silently.
Clearing it, and what breaks
You can clear cookies and site data from your browser’s settings at any time, and you can block cookies for this site entirely. We will not try to work around that, and there is no fingerprinting fallback.
What happens if you do:
- You will be signed out, and will need to sign in again.
- Game progress saved only on that device is lost. Progress made while signed in is stored on the academy’s server and follows the student to any device, so it survives — but anything played before signing in does not.
- Sound and narration preferences return to their defaults.
If you block cookies but still sign in, the platform will not be able to keep you signed in from page to page.
Changes
If we ever add a cookie, this table changes on the same day. If we ever add one that is not strictly necessary — which today we have no plan to do — we will ask for consent before setting it, not after.
Questions: [email protected]. See also the Privacy Policy.