Cookie and Advertising Technology Notice
What Medu and embedded providers store on your device, why they use it, and the controls available to you.
1. What this notice covers
"Cookies" here includes browser cookies, local storage, session storage, IndexedDB, device identifiers, pixels, SDK tokens, and similar technology. Some are set by Medu; others are set or read by independent providers when their service loads.
Storage duration varies: a session item normally ends when the browser session ends; a persistent preference remains until its expiry or until you clear it; provider technology follows the provider's settings and notice.
2. Strictly necessary and security technology
- Firebase Authentication: keeps you signed in, refreshes authentication, and protects the account.
- Firebase App Check and reCAPTCHA Enterprise: assess whether requests come from a legitimate app/browser and help prevent abuse. Google can process IP address, user agent, device, and security signals.
- Payment and entitlement state: connects checkout, verified orders, subscription status, and access to the signed-in account.
- Security and rate limiting: helps prevent repeated sign-in, payment, or feature abuse.
These technologies are necessary to provide a secure account or requested transaction and cannot be disabled through an analytics preference. Blocking them may prevent sign-in, checkout, or paid access.
3. Preferences and local study data
Medu uses browser storage for settings such as theme/accent, selected currency, shopping cart, dismissed notices, chat layout, muted users, audio setting, saved/followed groups, and some local flashcard or study-note progress. Session storage may hold temporary navigation, verification notices, voice-room passwords for the immediate join flow, AI source transfer between Medu tools, and short-lived MEDUPRO status cache.
These items normally remain until the session ends, Medu replaces them, you use a reset/delete control, or you clear browser data. They can be device- and browser-specific.
4. Medu first-party analytics
For signed-in users, Medu may create a session identifier and send allow-listed events: page path, broad device/browser category, coarse referrer category, performance timing, authentication-state event, and rate-limited frontend error count. The server stores one-way session/account hashes rather than the raw identifiers in the analytics report.
Medu does not intentionally include email, messages, question answers, AI prompts, payment references, or full referring URLs in this event. Some visitor and session records carry expiration metadata, while aggregate daily statistics may be retained longer to compare reliability and usage. Medu's retention criteria apply.
Medu respects the browser's Do Not Track signal for this first-party analytics. You can change the setting for this browser:
5. Embedded and connected services
- YouTube: an embedded video can send Google the page URL, IP address, device/browser data, cookies, and viewing interaction when it loads or plays.
- PayPal: checkout buttons and PayPal pages use provider cookies and identifiers for login, payment, fraud prevention, and preferences.
- Cloudinary: the upload widget and media delivery can receive IP address, device/browser data, upload data, and interaction information.
- Google sign-in and reCAPTCHA: Google technology may use security cookies or device storage to authenticate and detect abuse.
- Telegram: following a Telegram link opens an independent service that applies its own storage and privacy practices.
Medu cannot directly control provider cookies after you open or interact with the provider. See the provider links in the Privacy Notice.
6. Google AdSense and sponsored advertising
Where Google advertising is active, Google and approved advertising partners may use cookies, IP address, online identifiers, page context, device/browser information, ad interactions, consent signals, and inferred interests to deliver, limit, secure, and measure ads. Depending on your consent and region, ads may be personalized or non-personalized.
A Google ad tag can contact Google even when an ad slot is still being selected or no personalized ad is shown. Direct sponsors do not need cross-site tracking to place a labelled sponsorship; Medu may give them aggregate campaign totals but not private messages, detailed study performance, AI input, or payment credentials.
Medu does not sell personal data for money. Advertising-related disclosure can nevertheless count as "sale," "sharing," or targeted advertising under some laws. Applicable opt-out rights remain available. See the Advertising and Sponsorship Policy.
7. Consent and legal basis
Medu uses essential technology to provide the service you request and protect legitimate security interests. Where applicable law requires prior consent for analytics, embedded media, or advertising technology, Medu will request that consent and transmit relevant choices before activating the non-essential use. Continued browsing is not treated as consent where affirmative consent is legally required.
When a consent message is available, choose "Do not consent," "Consent," or "Manage options" as applicable. You must be able to revisit and withdraw consent as easily as you gave it. Withdrawal applies prospectively and does not affect earlier lawful processing.
8. Controls available to you
- Use the first-party analytics button above.
- Use the Medu or Google consent message's "Manage options" control where shown.
- Visit Google My Ad Center to manage Google ad personalization associated with your Google account.
- Use browser settings to block or delete cookies and site data. Blocking essential storage can sign you out or break checkout and saved preferences.
- Use browser or device controls to prevent autoplay or third-party content, or avoid loading an embedded video or payment widget until you choose to interact.
- You may enable a browser-based universal opt-out signal. Medu's response depends on the feature and current implementation; where applicable law requires recognition, Medu must apply the signal to the covered processing.
Choices are often browser- and device-specific. Clearing storage may clear the choice and require you to set it again.
9. Contact and updates
Questions about cookies or advertising technology: support@medu.courses. Medu will update this notice when technology, providers, or material practices change.