Cookie Policy
Last updated: October 19, 2026
In short
UnisPath uses only what it needs to sign you in and keep the site working. We run no analytics, no advertising, no social-media tracking and no session recording, and no third party places cookies through our pages. Because nothing we use needs consent, there is no cookie banner.
1. Cookies
| Name | What it does | How long | Type |
|---|---|---|---|
unispath_session | Keeps you signed in after you log in. Scripts cannot read it, it is sent only over HTTPS, and it is not sent with requests other websites make in the background (SameSite=Lax). | 5 days, or until you sign out | Strictly necessary |
site-access | Remembers that you entered the site access password. Only used while the site is behind a pre-launch password, which it is not at present. | 30 days | Strictly necessary |
2. Other storage on your device
These are not cookies — they are kept in your browser's storage (localStorage or IndexedDB) — but we list them so the picture is complete. Apart from the two Firebase items, none of them leaves your browser. The Firebase sign-in data holds the tokens that prove who you are: your browser sends them to Google's sign-in service to keep your session current and to UnisPath with each request you make, and for nothing else.
| Name | What it does | How long |
|---|---|---|
Firebase Authentication data (firebaseLocalStorageDb) | Holds your sign-in state so you are not asked to log in on every page. Kept in browser storage (localStorage or IndexedDB) by Google's Firebase Authentication library, which UnisPath uses for sign-in. | Until you sign out |
firebase-heartbeat-database | Kept by the same Firebase library: the date it was last used and its version number, which it reports to Google with sign-in requests so Google can tell which versions are in use. | Until you clear your browser data |
unispath_onboarding_dismissed | Remembers that you closed the portal's getting-started guide. | Until you clear your browser data |
unispath_ai_chat_open | Remembers whether you left the assistant panel open or closed. | Until you clear your browser data |
crm_dashboard_layout_v1 | Remembers how you arranged your dashboard. | Until you clear your browser data |
unispath.schoolYearNudge.<year> | Remembers that an administrator dismissed the start-of-year reminder to update student grades. | Until you clear your browser data |
3. What we do not use
- No analytics tools, such as Google Analytics.
- No advertising or retargeting cookies or pixels.
- No social-media plugins that track you.
- No session-recording or heat-map tools.
- No embedded third-party content that sets its own cookies. Webinars on Google Meet open in a separate Google window, where Google's own cookie policy applies. Signing in with Google or Microsoft opens a pop-up window run by Google's Firebase sign-in service, which takes you to Google's or Microsoft's own sign-in page, where their cookie policies apply. On some browsers Firebase also loads a hidden Google sign-in frame on signed-in pages; it keeps its own browser storage under Google's domain for sign-in only, and sets no cookies through our pages.
If we ever add any of these, we will update this policy and Section 20 of our Privacy Policy first, and ask for your consent before anything non-essential is set.
4. Legal basis
The cookies and storage above are used because they are needed to provide the service you asked for — signing in and using your account. The UAE Personal Data Protection Law has no separate cookie-consent rule; for visitors in the EU and UK, the ePrivacy rules exempt strictly necessary storage from consent.
5. Controlling cookies
You can block or delete cookies and site data in your browser settings. If you block unispath_session or the Firebase sign-in data, you will not be able to sign in.
6. Changes
The date at the top of this policy changes whenever the policy does. If we add anything that is not strictly necessary, we will ask for your consent before it is used.
7. Contact
Questions about this policy can be sent to privacy@unispath.com.