# CoreDrive cookies and device storage

**Public URL:** https://coredrive.co.uk/cookies/

**Last updated: 23 October 2026**

CoreDrive is one platform with separate modules, delivered through standalone apps, websites and the comprehensive CoreDrive app. Instructor Websites is a separate web app with its own subscription and is not included in Full CoreDrive, the comprehensive app.

COREDRIVE PRIVATE LTD is responsible for storage or access it operates or triggers in Mock Test, Street Canvas, Progress & Reflections for instructors, Progress & Reflections for learners, Instructor Websites and the comprehensive CoreDrive app, the main website, shared account and CoreDrive-delivered email. Use our [privacy enquiry form](https://coredrive.co.uk/contact/?enquiry=privacy) for free help. Business contact details and accessible alternatives are on the [Contact page](https://coredrive.co.uk/contact/#business-contact). Read this with the [privacy notice](https://coredrive.co.uk/privacy/) and [terms, payments and refunds](https://coredrive.co.uk/terms/).

## Current main website

This marketing website uses no browser analytics, advertising cookies or persistent form storage; unsaved form entries remain in page memory only. Current Cloudflare delivery and enquiry protection, IONOS email and Microsoft forwarded-copy handling are explained in the [main website privacy details](https://coredrive.co.uk/privacy/#main-website-privacy), including provider recovery and overseas processing. These necessary service operations do not enable the optional app technologies described below. The apps and self-service website service remain planned; their account/editor storage is not activated by browsing this website.

When you view the school demo, `coredrive.school-demo.v1` stores known return pages/sections, an origin label and start time in this tab’s sessionStorage for up to two hours or tab closure. No identities, form answers or analytics uploads. Page requests carry destination/demo labels and original start time; links still work if storage is blocked.

## Your choices at a glance

- **Necessary storage** helps provide what you request, such as sign-in, saved work and remembering a privacy choice. It is not permission for advertising or unrelated tracking.
- **Optional analytics, screen replay and crash diagnostics start off.** When offered, each has its own first-use choice and Privacy setting. Skip or decline and you can still use the ordinary app. Private journals, learner reports, passwords and payment screens are excluded from optional recording even if you opt in.
- **Changing your mind is allowed.** Use the available Privacy controls or the [privacy enquiry form](https://coredrive.co.uk/contact/?enquiry=privacy) for free help or withdrawal. A new choice cannot make earlier unauthorised recording acceptable. Instructor Websites allows only anonymous server-prepared monitoring summaries, not user-linked PostHog recording.
- **Clearing files is different from deleting an account or cancelling payment.** Save needed work first; clearing device data can remove unsynchronised records.

Read about [necessary and optional uses](#2-necessary-and-optional-uses), [choices and cleanup](#3-your-choices-and-cleanup), [app files, maps and email](#4-app-files-maps-and-email) and [removing files](#5-removing-files). The [privacy notice](https://coredrive.co.uk/privacy/) explains personal information and your rights.

## 1 What this covers

Modules and their delivery apps are released as they complete internal testing and launch preparation. Only functions identified as available are offered; describing planned modules does not promise a release date or include unavailable paid features.

This shared pack applies across the CoreDrive platform, including future modules and delivery apps where relevant and supplied for that service. Before a new service or materially different use begins, we explain its actual features, data handling and applicable terms and obtain any required agreement or consent. This scope does not expand existing purchases, permissions or access rights.

The apps serve UK instructors, customers and learners only. This intended audience does not establish where providers process information or exempt device access involving other visitors from applicable duties.

“Device storage” includes cookies, browser databases, app files/preferences, caches, protected keys, SDKs, pixels, tracking links and fingerprinting. It includes relevant collection or monitoring of information automatically emitted by a device, and operations we instigate through providers. The rules apply even where information is not personal. Calling an item first-party, anonymous or necessary does not establish permission.

Our service rules exclude advertising technology, cross-service behavioural tracking and selling user information. Private learning records, reflections, health information, exact location, credentials and unnecessary third-party information must never enter optional diagnostic records, including before upload. An instructor's choice does not authorise capture of their learners' personal information.

For Mock Test, Street Canvas, both Progress & Reflections apps and the corresponding functions in the comprehensive app, where enabled under the safeguards below, CoreDrive uses PostHog for user-linked usage analytics, automatic interaction tracking, session replay and technical crash/error reports. Approved monitoring may include a restricted user identifier, app/session identifiers, permitted interactions and device/app version information. Linked or pseudonymous information remains personal information; it is not described as anonymous. Optional monitoring stays off before local capture until the relevant informed, freely given choice covers its purpose and scope. Analytics, session replay and crash diagnostics need distinct understandable purpose choices; refusing or withdrawing must preserve ordinary app access. An instructor’s choice does not authorise collecting a learner’s details.

For user-linked PostHog monitoring, use a random internal monitoring ID specific to the app. Do not send names, email addresses, hashed contact details or the shared CoreDrive account identifier as the monitoring identity. Keep the minimum account-to-monitoring-ID mapping restricted inside CoreDrive so authorised privacy requests and deletion can locate the relevant records. App-scoped IDs and necessary session references remain personal information; they must not be described as anonymous or merged across apps. Retain the mapping only while needed for lawful monitoring, rights handling and verified removal of relevant controlled/provider copies, with finite documented review and deletion criteria.

Session replay and automatic tracking must exclude learner contact and report screens, private reflections, support/rights material, passwords, payment details and other restricted content. Masking must apply before capture or transmission; if exclusion cannot be verified on a platform or screen, recording/tracking stays off there. Technical crash reports may include the error type and permitted stack information, but must remove private values, tokens, request/response bodies and learner content before capture. “Raw crash reports” does not authorise unfiltered personal-data dumps. Account changes and withdrawal must reset or stop the relevant collection and prevent unauthorised queued upload. The intended PostHog EU Cloud region, exact provider entities, access/transfers, device/server/backup periods, rights/deletion support and actual controls must be verified before use. The selected PostHog route must meet these controls and the retention limits below before capture. No marketing, advertising, AI training or independent reuse of tuition records is authorised by monitoring.

In the comprehensive app, monitoring choices and restricted-content exclusions apply to each relevant module as well as the app. Your choice in a standalone app does not automatically permit capture in another app or a new module. Instructor Websites is separate from the comprehensive app and retains its anonymous-summary-only monitoring limit. Before monitoring a future project, we explain the actual technologies and purposes and obtain any required prior choice.

## 2 Necessary and optional uses

Strictly necessary storage/access is confined to providing the service you request. Examples can include secure sign-in, an access check, requested working records, saved work and remembering a privacy choice. Every actual operation and duration needs assessment. Necessary service security/fraud/fault detection cannot be reused for optional profiling. The separate transmission exception is confined to carrying a communication over a network. Revenue, convenience or a provider dependency is insufficient.

Optional diagnostics are consent-only and stay off until a valid affirmative choice covers their purpose, person and scope. Other optional usage collection follows that same default unless we specifically identify an operation and purpose before use that meets the separately assessed exception conditions below, without weakening an earlier binding consent-only promise. This applies to local recording, access and transmission, including SDK startup and background use. Disabling upload alone is insufficient. We explain the purpose, information, named material third parties, periods and effects first; consent choices are separate and unticked. Silence, installation, continued browsing, terms acceptance, a purchase or operating-system permission is not the required consent. Personal information also needs its own lawful basis and safeguards.

UK law has narrow service-improvement statistics and appearance/functionality exceptions. We may rely on one only after assessing every condition, explaining the purpose and providing a simple free objection control **before use** and throughout it. Statistics must solely improve the particular service/website, with sharing confined to assistance with those improvements; the exception excludes collection or monitoring of automatically emitted device information. Our baseline requires aggregate, non-identifying results without individual decisions, profiling or wider reuse. Appearance/functionality has its own confined purpose. Children's high-privacy protections and store requirements still apply. Optional uses remain consent-only unless we first identify the specific qualifying operation and provide its required information and objection control. An earlier refusal or withdrawal for that purpose remains an objection; changing legal labels cannot override it. Ordinary education/maps are not emergency assistance.

## 3 Your choices and cleanup

Where optional app monitoring is available, we provide a brief, skippable first-use panel and the same controls in Privacy settings. Usage analytics/automatic tracking, session replay and crash diagnostics have separate, clearly explained switches, all initially off. Skipping or declining leaves ordinary app access available and does not count as consent. Before your choice, we explain each purpose, permitted information, provider and retention period. You can change or withdraw a choice in Privacy settings as easily as enabling it. These choices are separate from marketing and terms acceptance. Optional monitoring stays off unless these choices and capture controls are available and effective.

Accept, reject and customise must be equally prominent; rejection and withdrawal must be as easy as granting consent, with no pressure or preselected optional purpose. Controls must work with keyboard/assistive technology and be understandable to children likely to use the service. Website choices need a persistent route without login; app choices need an accessible setting, including outside a paid feature once access expires. The enabled service identifies the available controls; email remains a free route for help and withdrawal.

Refusal, withdrawal or objection must not reduce ordinary free, paid, trial or testing access, change prices or remove rights. A function whose optional purpose you decline may be unavailable only with its explained effect; necessary independent access and lawful alternatives remain. If optional embedded technology is blocked, the agreed content/function must remain available through a genuinely equivalent accessible route that respects your choice and protects restricted records.

You can withdraw consent at any time or object through the relevant control, email or another lawful/necessary accessible route. We promptly stop identifiable affected optional processing we control from first receipt, including while genuinely necessary authority checks for protected actions continue. We safely resolve an unverified request with the genuine holder; failure to verify does not automatically restart optional use. Unless you limit it, a general purpose-specific stop covers the relevant services/devices we can identify and control, without extending an earlier grant or changing another person's choice.

We remove controlled optional storage and unsent queues, stop transmission where technically possible, and instruct affected recipients to stop. A later grant cannot upload records captured without applicable permission. Withdrawal is also treated as an erasure request for personal information collected under that consent; objections require assessment of retained identifiable inputs for prompt lawful erasure. As controller we perform required erasure and recipient notices; as processor we promptly forward and assist the actual controller without delaying our own cessation or resetting original dates. The privacy notice explains rights clocks and any specific finite lawful retention. Already delivered information cannot simply be recalled in transit. We explain remaining third-party/device removal steps and assist.

Valid consent must cover the current person and operation. We require confirmation before relying on a grant after first sign-in, sign-out/account switch, reinstall, restore or migration to another device; suspended pre-login or installation-linked processing stays off until the current user makes the required choice. A fresh valid anonymous choice after sign-out can cover that newly disclosed scope. Another person's old browser/app choice is not consent for your identifiable information. Current refusals, withdrawals and objections survive restart, exceptions and recovery. If a controlled change loses their scope, the affected optional use stays off until that choice can be honoured or you clearly choose otherwise. We keep only justified minimum choice evidence with finite periods/review criteria; device access for extra evidence purposes needs its own assessment. There is no universal legal cookie-consent expiry.

## 4 App files, maps and email

| Category | Purpose and limits |
| --- | --- |
| Shared account / purchases | Protected requested sign-in and entitlement information. Account sharing is not shared consent. |
| Mock Test / Progress & Reflections instructor and learner apps | Requested working records, offline queues and temporary exports/caches. Actual audience, controller instructions and sensitive-data conditions apply. |
| Street Canvas | User-saved artwork, map caches and recent searches. Recent-search history is limited to five entries; local device/app-data controls can remove stored copies, but may also remove unsynchronised artwork. A count limit alone does not justify keeping an unnecessary location history. Local files can contain locations and personal information. |
| Usage analytics and automatic tracking | PostHog user-linked permitted interactions and technical properties, with prior purpose-specific choice, restricted identifiers and no learner/private content. We disclose the actual events, access, device lifetimes, controls and provider periods before enabling collection. |
| Session replay | PostHog recording of permitted app screens after a separate choice. Exclude restricted learner, private and support/rights screens entirely, even with masking. Mask permitted fields on other allowed screens before capture; unverified surfaces remain unrecorded. Recording stays off unless platform-specific exclusion, masking and finite deletion are verified. |
| Optional crash diagnostics | PostHog technical errors and permitted stack details after a separate choice, sanitised before capture. No private payloads, credentials or learner information. No other optional crash SDK may collect information outside the same choices, exclusions and retention rules. |
| Outbound email | Amazon SES is the selected shared transport for separately authorised account/service/report and optional promotional messages. It is not a support inbox, shared marketing permission or UK-only processing guarantee. Actual provider content/log/backup periods and security must be established before this route is enabled; open/click engagement tracking stays off. |
| Learner age checks | Supported Apple/Google age-range requests and minimum app-scoped eligibility evidence. Actual device access, temporary caches, source/method and finite periods must be assessed before use. Missing signals use the privacy notice's proportionate fallback. No store-derived age signals/decisions in marketing, analytics or cross-app profiles; this request is separate from optional monitoring consent. |
| Privacy choices / protected keys | Minimum necessary choices and requested security functions, with assessed access, retention and cleanup. |

Requested Street Canvas maps and postcode lookups can send your network address, area/search terms and technical information to the actual provider. Mapbox and postcodes.io are selected integrations where enabled; we identify the provider for the function you use before its requests begin. Keep private learner details out of searches; CoreDrive must prevent unnecessary additions. Current-location access needs the appropriate device permission and purpose choice; manual search/selection remains available if refused. Location permission does not authorise optional telemetry. Set up safely under the [driving safety rules](https://coredrive.co.uk/safety/).

Relevant Mapbox telemetry opt-out and attribution must remain accessible alongside CoreDrive's required choices if that SDK is used. Telemetry improving a provider's own products needs prior consent and cannot use CoreDrive's statistics or necessity exception. Provider comparison/sharing features remain disabled unless separately lawfully assessed and covered. If an integration cannot honour these rules, keep it disabled or replace it; a supplier setting is not proof of compliance.

External images, fonts, maps, videos, payment/support components and rewritten links need assessment of actual requests, operators, purposes and periods before activation. A click or payment does not permit unrelated tracking. Our baseline disables recipient-level open, click and link measurement in **all marketing and service messages**, including requested reports to people without accounts. Necessary delivery, security and unsubscribe operations are distinct. Marketing permission is separate from device consent.

Required PostHog retention limits before collection is enabled: 30 elapsed days for new session recordings; 90 elapsed days for user-linked analytics/automatic events and crash/exception events, conditional on a verified lawful deletion arrangement; and 14 elapsed days for separately enabled diagnostic logs. Each clock starts with its original recording/event/log creation and must not be restarted by viewing, investigation or restore. Cloud analytics/event retention cannot be reduced through a setting or request; replay has a separate configurable period that affects new recordings only. Keep affected identifiable capture off until actual cleanup, provider copies and the stated periods can be verified. Device cookies/SDK identifiers, choice evidence and local queues require their own finite inventory periods; these server targets do not specify or authorise unlimited device storage.


### Instructor Websites

Public school sites have a necessary-only baseline: no customer tracking tags, advertising pixels, social feeds or automatic video/map embeds. Approved Facebook/Instagram links are ordinary external links; following one engages that provider’s own processing. Hosted content still involves necessary delivery/security requests and logs; “no analytics cookie” does not mean no personal data or automatic exemption. Account/editor storage is separate from public school hosts: protect sign-in with scoped session storage/cookies and CSRF controls, never broad cross-school authentication cookies. Website sessions must meet a 30-minute idle and 12-hour hard limit before use; these do not establish every cookie/file’s lifetime.

Website portfolio monitoring permits only anonymity-qualified server-prepared totals. No user-linked website PostHog SDK, replay, autocapture, raw-error collection or cross-project identity merging is authorised. Necessary operational source records remain separately governed. The driving/learning apps’ optional monitoring choices do not change this website boundary or opt someone into website tracking.

A Cloudflare Turnstile challenge is conditional on an actual purpose, provider/transfer/device-access assessment and accessible alternatives; it is not automatically necessary or consent-exempt. We must identify its actual information, access and lifetime before activation, and avoid learner details in challenge metadata. Requested enquiry protection and rate limits must not obstruct direct privacy/withdrawal contact. Optional FCM push has its own enable/disable/device selection, clear information and suitable platform permission; an operating-system permission is not consent to unrelated analytics. Tokens/bindings and unsent queues have finite qualified periods. Sign-out, user/device/app change and website deletion must stop stale routes without deleting unrelated module preferences. In-app content retrieval still needs current authorised access.

Before enabling a technology, we provide its actual supplier/device lifetimes, relevant challenge/session names, choices and removal instructions. A function stays off where its required safeguards or information are unavailable. If optional remote spelling, media or embed technology is later offered, assess and disclose it separately before use; no enhanced-browser spellcheck or third-party text sending is silently enabled. Email open/click tracking remains off for website messages too.

## 5 Removing files

Moje Solutions Ltd follows the same storage, monitoring and deletion rules when operating the service for CoreDrive. Its role does not give permission for additional tracking or access to your device.

We must provide verified removal steps for supported apps/devices. Optional cleanup must preserve necessary work and records; broad device clearing/uninstalling can lose unsynchronised work, so save lawful copies first. Independent exports, Photos and device/cloud backups use their own controls; we still fulfil duties for controlled copies and required recipient notices. Restores must honour current deletion and stop decisions before reuse. Clearing local data does not delete a server account, cancel a subscription or unsubscribe from email; those are separate requests with the privacy and terms protections.


For an ordinary concern about CoreDrive’s cookies, device access or this notice, please contact CoreDrive first using the [complaints form](https://coredrive.co.uk/contact/?enquiry=complaint) so we can investigate and try to resolve it before escalation. The [terms’ complaints process](https://coredrive.co.uk/terms/#complaints--contact-coredrive-first) and the [privacy complaints route](https://coredrive.co.uk/privacy/#6-requests-complaints-and-changes) explain responses and review. You can still contact the ICO or another appropriate authority, obtain advice or use available legal remedies without completing our process; urgent reporting and statutory deadlines must not wait. Refusal, withdrawal and objection take effect under their own rules, independently of a complaint.

This notice does not reduce a greater commitment already binding on us. Material processing changes need timely information and lawful authority, preserving current choices. Free help, protected privacy requests and direct ICO/court routes remain available under the privacy notice.