What is set
| Cookie | Set when | Purpose | Lifetime |
|---|---|---|---|
| PHPSESSID | You sign in, submit a form, or use the Scholar Desk | Keeps your session and carries the CSRF token that protects form submissions | Cleared when you close the browser, or on sign-out |
The session cookie is marked HttpOnly so scripts cannot read it, Secure over HTTPS, and SameSite restricted so it is not sent from other sites. The admin console uses the same mechanism with a stricter SameSite setting.
What is not set
- No advertising or retargeting cookies.
- No analytics cookies. Scholar does not load an analytics script.
- No social network pixels or share-tracking cookies.
- No cross-site or third-party profiling identifiers.
One optional third-party script
Newsroom article pages may load Google's Subscribe with Google publisher script so that Scholar can be recognised as a preferred source in Google News. That script is served by Google and is subject to Google's own terms and privacy practices. It is loaded only on newsroom article pages, only when the feature is enabled, and it is not used by Scholar to identify you. No other third-party script runs anywhere on this site.
Browsing without cookies
Every public page works with cookies blocked: country guides, university and scholarship research, guides, planning tools and the newsroom. Only signing in, saving research and checkout need the session cookie, because those actions have to know who you are.
Controlling cookies
You can block or delete cookies in your browser settings. If you block the session cookie you can still read everything public, but you will not be able to sign in or complete a purchase.
Server logs are not cookies
The hosting provider keeps standard web server logs, which include IP addresses, for security and diagnostics. That happens at the infrastructure level and does not depend on cookies. See the privacy policy.