Legal
Cookie Policy
Last updated: August 1, 2026
What cookies are
Cookies are small text files that websites store on your device. They let us keep you signed in, remember your preferences, and measure how the site is used.
Cookies White Coat World uses
- Authentication. NextAuth/Auth.js session cookies (
authjs.session-tokenornext-auth.session-token). Required to keep you signed in. Expires when you sign out or after session expiry. - CSRF protection.
authjs.csrf-token. Required for sign-in flow security. - Feature flags / preferences. A small number of cookies remember UI state (sidebar collapsed, etc.).
Analytics
Our product analytics (PostHog) runs entirely server-side. It records anonymized, event-level usage (which features are used, not who used them) keyed to a random account identifier — never your name, email, GPA, or application content. Because there is no in-browser analytics script, White Coat World does not set analytics or advertising cookies of its own on your device. We do not sell this data.
Third-party cookies
There is exactly one source, YouTube, in two places — and it is worth naming precisely rather than leaving to a general disclaimer.
- YouTube on the public homepage. Our marketing homepage embeds an introductory video hosted on YouTube. That embed loads as soon as the page does, which lets Google set its own cookies on your device — including if you have no account and have never signed in. We do not control those cookies and we receive nothing from them.
- YouTube in the Boards & Tests classroom. Video lessons are hosted on YouTube. Nothing is loaded from Google until you press play. A lesson you have not started is a plain placeholder card drawn by us — no YouTube frame, no YouTube script, not even a thumbnail — so simply opening a chapter sends Google nothing at all. When you do press play, the video loads through
youtube-nocookie.com, Google’s reduced-tracking host, and Google may then set cookies on your device. The only thing sent is the ID of the video you chose to watch: never your name, your answers, your scores, or anything else from your account.
One further third party runs in your browser without setting a cookie for us: the optional location field in the social layer uses Google Places for autocomplete, which sends the text you type in that one field to Google. It is not part of your academic profile or advising workflow.
What we do not use
- No analytics or advertising cookies of our own.
- No cross-site tracking pixels, and no advertising network of any kind.
- No Facebook/Meta or Google Ads pixels.
- No cookie sets on any signed-in page other than the sign-in, security, and preference cookies listed above — and the YouTube cookies described above, which are set only if you press play on a lesson.
Your choices
You can disable cookies in your browser settings, but core features (sign-in, messaging, account) will stop working. Our own analytics is server-side and PII-free, so there is no opt-out for us to offer. To avoid the YouTube cookies specifically: do not load the homepage video, and do not press play on a lesson. That is the whole reason lessons do not load until you click — declining is a matter of not clicking, and every other part of the classroom (notes, cheat sheets, flashcards, question banks, practice tests) works exactly the same either way. Blocking third-party cookies in your browser also stops them.
Contact
Questions? Contact us.