This notice explains what BATAS stores in your browser and on your device when you use batas.org and the Batas desktop application, why we store it, how long it lasts, and how to remove it. It should be read with our Privacy Policy.
1. The short version
- We use no advertising cookies, no advertising identifiers, and no advertising trackers.
- We use no third-party analytics. The Service contains no Google Analytics, no Meta pixel, no session-recording tool, and no similar tracker. Our usage statistics are computed on our own servers from the requests you make.
- What we store in your browser is strictly necessary to make the Service work (keeping you signed in) or is your own preference (your theme, playback speed, audio quality, caption size). Nothing is stored to profile you for advertising, and we do not sell anything to anyone.
- We do not put a consent wall in front of the Service. Because we do not do non-essential tracking, there is nothing to consent to before you read a page. If we ever add a non-essential cookie or tracker, we will ask for your consent first, and this notice will say so.
2. What is stored, and why
2.1 Local storage in the app (batas.org and the desktop app)
These are written by the application itself. Local storage is not a cookie: it is not sent with every request, and it lives only in the browser profile (or the desktop app’s own storage) on the device you are using.
| Key | What it holds | Why | How long it lasts | Type |
|---|---|---|---|---|
batas_token |
Your signed-in session token (a bearer token, not a password) | Keeps you signed in between visits; the token can be revoked by signing out | Up to 90 days, or until you sign out | Strictly necessary |
batas_user |
The name, email, avatar reference, and access rights of the signed-in account | Lets the app draw your account menu and decide which courses are open before the first server response arrives | Until you sign out | Strictly necessary |
batas_device_id |
A random identifier for this browser or device | Lets the service manage this session and, in the desktop app, pair the app with your account | Until you clear your browser storage | Strictly necessary |
batas_ai_convos_<your user id> |
A local copy of your most recent AI study conversations | So your conversation is still there when you come back. Your conversations are kept in your browser, not in our database: we store only the counters for the tokens each account has used. | Until you clear your browser storage | Functional |
batas_theme (in the desktop app, batas-theme), batas_quality, batas_hub_program, batas_player_speed, batas_player_zoom, batas_player_cc, batas_player_ccsize, batas_player_theme, batas_playlist_promo_v1, batas_rings_won |
Your preferences and small “already shown” flags: light or dark theme, audio quality, playback speed, player zoom, caption on/off and size, the last dashboard programme you looked at, whether a one-time promotion has been dismissed, and whether today’s study-goal celebration has already fired | To make the Service behave as you set it up, and not to repeat things you have already seen | Until you clear your browser storage, or one calendar day for the study-goal flag | Preference / functional |
batas_api_base |
A developer override for the API address | Used only for development and testing builds; never set in normal use | Until removed | Strictly necessary (development) |
2.2 Session storage
batas_signup_note in session storage carries a short message from the account-creation step to the next page (for example “check your email”). It is deleted when you close the tab.
2.3 Cookies set by the batas.org WordPress pages
Some parts of batas.org are served by WordPress: the login and sign-up pages at /login/ and /signup/, the password-reset pages, the comment and account-management screens, the administrator area at /wp-admin/, and the pages you are reading now. On those pages WordPress sets its own functional cookies:
| Cookie | What it holds | Why | How long it lasts |
|---|---|---|---|
wordpress_test_cookie |
A check that your browser accepts cookies | Needed for the login form to work at all | Session |
wordpress_logged_in_<hash> |
Your WordPress login session | Recognises you on the WordPress-served pages and in the administrator area | Session, or 14 days if you choose “remember me” |
wordpress_sec_<hash> |
A security cookie for the secure part of the site and the administrator area | Protects the authenticated pages against cross-site request forgery | Session, or 14 days with “remember me” |
wp-settings-<id>, wp-settings-time-<id> |
Your interface preferences in the WordPress-served area | Remembers how you arranged the screens you use | One year |
comment_author_<hash>, comment_author_email_<hash>, comment_author_url_<hash> |
Details you enter in a comment box | So you do not have to retype them next time | One year from setting, and only if you comment |
All of the above are strictly necessary for the pages that set them to function or to remain secure. They are not used for advertising or profiling, and they are not shared with third parties for their own purposes.
2.4 Cookies set by others, not by us
- Google Sign-In. If you choose to sign in with Google, Google’s own pages set Google’s cookies on Google’s domain, under Google’s privacy notice. We do not set them, we cannot read them, and we do not advertise with them.
- Payment processing. When you pay, you are taken to our payment processor’s checkout pages, which set their own security and fraud-prevention cookies and identifiers on their own domain or on our checkout pages. We do not receive their cookie data; we receive only the outcome of the transaction.
- Content delivery. Our content-delivery provider serves audio and library files from edge servers using signed, expiring links. It does not set advertising cookies, and the links expire, so protected files cannot be fetched from a link that has been shared.
3. How to remove, block, or limit what is stored
- Sign out to end your session and clear your session token from this browser.
- Clear site data: in your browser settings, look for “Cookies and site data”, “Storage”, or “Site settings”, find batas.org, and delete the stored data. In the desktop application, signing out and clearing its data directory removes the local copy of your session and preferences.
- Blocking storage: you can set your browser to block cookies or site data. If you block strictly necessary storage, you will not be able to stay signed in, and some pages will not work. This is a limitation of how logins work, not a choice we are making about you.
- Private or incognito windows do not keep local storage after you close them, so you will have to sign in again each time.
- Do Not Track / Global Privacy Control: the Service does not track you across other sites, so there is nothing to switch off; we honour a browser signal that asks us not to sell or share personal data, which we do not do in any case.
4. What we will do before we change this
If we introduce a cookie, a tracker, or a storage item that is not strictly necessary or a simple preference — anything used for advertising, for cross-site tracking, for measuring you against other people, or for a third party’s own purposes — we will tell you before it goes live, ask for your consent where the law requires it, and offer a genuine choice with no penalty for refusing. The National Privacy Commission’s guidelines on consent are clear that consent must be freely given, specific, informed, an express act of assent, and as easy to withdraw as it was to give, and that bundles and pre-ticked boxes do not count. We build to that standard.
Version history of this document
- 1.0 — first version.
5. Questions
Write to our Data Protection Officer at batas.org@gmail.com and we will explain in plain terms what a particular item in your browser does.