Cookie Policy
Effective: 9 June 2026 · Version 2.1.0 Supersedes: Cookie Policy v2.0.1 dated 7 June 2026
This Cookie Policy explains what cookies are, which cookies the Skilly platform sets, and what choices you have. It is published by Skillscan Limited (trading as Skilly) and forms part of our Privacy Policy.
In one sentence: inside the signed-in platform we set only strictly-necessary cookies and run no analytics of any kind. On our public marketing pages we use Google Analytics to understand how visitors and campaigns find us — but only after you accept it on our cookie banner; if you decline, it never loads. We run no advertising or behavioural-tracking cookies anywhere.
1. Who we are
| Field | |
|---|---|
| Legal entity | Skillscan Limited |
| Trading name | Skilly |
| Company registration (CRO) | 565995 |
| Registered office | 5 Kinross, Fey Yerra Lane, Leopardstown Road, Foxrock, Dublin 18, Ireland |
| Data protection contact | legal@skillysolutions.com |
2. What is a cookie?
A cookie is a small text file placed on your device by a website you visit. Most modern web applications use cookies to keep you signed in, to protect forms from cross-site request forgery, and to remember preferences. Cookies are sent back to the website that set them on each subsequent request.
Cookies are governed in Ireland and the EU by the ePrivacy Regulations 2011 (which implement Directive 2002/58/EC) and, where the cookie also processes personal data, by the General Data Protection Regulation 2016/679.
The ePrivacy framework distinguishes between:
- Strictly necessary cookies — required to deliver a service the user has explicitly requested. These do not require consent.
- Non-essential cookies — including analytics, advertising, social-media plugins, and behavioural tracking. These require informed prior consent before being set.
3. The cookies we currently set
On the signed-in platform we set only the three strictly-necessary cookies below — never analytics. On the public marketing pages we additionally set Google Analytics cookies, but only if you accept them on the cookie banner; decline, and they are never set.
| Cookie | Purpose | Lifetime | Type | Consent required? |
|---|---|---|---|---|
skilly-session | Authenticated user session — only set after you sign in. HttpOnly, Secure, SameSite=Strict. Without this cookie you cannot stay signed in between pages. | Per role: 8 hours for admins, 24 hours for coordinators, 3 days for teachers and pupils | First-party · session token | No (strictly necessary) |
skilly-csrf | Cross-site request forgery protection token, used to verify form submissions originate from the platform itself. Without this, any state-changing action would be vulnerable to CSRF attacks. | Session (deleted when you close your browser) | First-party · security token | No (strictly necessary) |
skilly-consent | Records your accept / decline response to the cookie banner on our marketing pages so we do not ask again. Set the moment you choose on the banner. | 1 year | First-party · preference | No (strictly necessary) |
On the public marketing pages only — and only after you accept on the cookie banner — we additionally set Google Analytics 4 cookies:
| Cookie | Purpose | Lifetime | Type | Consent required? |
|---|---|---|---|---|
_ga, _ga_<id> | Google Analytics 4 — tells how many people visit our public pages and which sources / campaigns bring them, using an anonymous visitor id. Set only on marketing pages and only with your consent; never on the signed-in platform where pupils are. | up to 2 years | Third-party (Google) · analytics | Yes — set only with your consent |
We set no other cookies anywhere on the platform.
4. What we do NOT use
Aside from the cookieless Vercel Web Analytics and the consent-gated Google Analytics on our marketing pages (Sections 3 and 6), we do not set any of the following on either skilly.ie or app.skilly.ie:
- Analytics on the signed-in platform — none, ever. The only analytics we run is on our public marketing pages: cookieless Vercel Web Analytics, plus Google Analytics 4 that loads only after you accept on the cookie banner. We use no Plausible (cookie-mode), no Fathom, no Hotjar, no Mixpanel, no FullStory, and no analytics of any kind on the signed-in platform.
- Advertising / retargeting pixels — no Google Ads, no Meta / Facebook Pixel, no LinkedIn Insight Tag, no TikTok Pixel.
- Social media widgets — no Facebook Like buttons, no embedded Twitter timelines, no YouTube auto-embeds with cookies (we use privacy-enhanced embed mode where video is shown).
- Session-replay tools — no recording of user sessions.
- Third-party fonts — fonts are self-hosted; no Google Fonts cookie.
- Third-party CDNs setting cookies — we do not embed any third-party scripts that set cookies.
If you inspect cookies while using the signed-in platform you should see only the three strictly-necessary cookies above and no others. On our public marketing pages, if you have accepted on the cookie banner, you will additionally see the Google Analytics cookies (_ga, _ga_<id>). If you ever see a cookie not on this list, that is a defect — please tell us at legal@skillysolutions.com.
5. Other browser storage
Some web applications use technologies similar to cookies — local storage, session storage, IndexedDB. The Skilly platform uses session storage sparingly to cache role-specific UI state (for example, your preferred filter on a page) for the duration of a single tab session. Nothing in session storage is shared with any third party, persists between browser sessions, or carries personal identifiers. It is cleared when you close the tab.
6. Marketing-site analytics, and product analytics in future
We draw a hard line between two different things:
- Marketing-site traffic analytics — understanding how many people visit our public marketing pages and which pages they read. This is provided by Vercel Web Analytics, which is cookieless and aggregate-only: it sets no cookies, stores no personal data, does no cross-site tracking or fingerprinting, and never identifies an individual visitor. Because nothing is stored on or read from your device, it falls outside the consent requirement of the ePrivacy Regulations. We also run Google Analytics 4 on these marketing pages to attribute visits to the sources and campaigns that bring people to us. Unlike Vercel, GA4 sets cookies — so it loads only after you accept on the cookie banner (decline and it never loads), and never on the signed-in platform. Both run only on our public marketing pages.
- Product analytics on the signed-in platform — understanding feature usage inside the app. We have made a deliberate choice not to ship third-party analytics here, and we run none today.
When the time comes to understand in-app product usage in more depth (for example, which features teachers use most often, where coordinators get stuck), the route we will take is self-hosted, privacy-first analytics — not a third-party tracker on pupil-facing screens. Concretely:
- A self-hosted instance of a privacy-respecting analytics tool such as Umami or PostHog Community Edition, deployed on our own infrastructure inside the EU
- Configured to not set cookies (these tools support an anonymous-visitor mode using hashed identifiers, with no tracking across sessions)
- Configured to not collect personal data — no IP address retention beyond what is needed for spam filtering, no cross-site tracking, no fingerprinting
- Aggregate metrics only, never individual user behaviour
Properly configured along these lines, the resulting analytics typically falls outside the consent requirement of the ePrivacy Regulations, because nothing is being stored on or accessed from your device.
If we ever introduce anything that does require consent (a non-essential cookie, a third-party tracker, anything fingerprintable), we will:
- Display a clear consent banner before any non-essential storage is accessed
- Default to reject — non-essential cookies are off until you opt in
- Update this Cookie Policy with the new tool, the new cookie, the lawful basis, and the retention period
- Notify the school admin by email for material changes
We will not roll out tracking technology silently behind a "by continuing to use this site you agree" notice. That model does not meet the GDPR consent standard and we will not use it.
7. How to control cookies in your browser
Even though our cookies are strictly necessary and do not collect personal data, you remain in full control. You can:
- Block all cookies — your browser will let you do this in its privacy settings. The platform will not work because you cannot stay signed in. We mention this for completeness; we do not recommend it for the Skilly platform itself.
- Clear cookies — your browser will sign you out of the platform immediately. Useful on a shared school device.
- Use private / incognito mode — cookies live only for the duration of the private window and are deleted when you close it.
Browser-specific instructions:
8. Children's privacy
The Skilly platform is used by pupils aged 12 to 18. We have deliberately limited the cookie footprint to the absolute minimum necessary so that pupils — including those below the Digital Age of Consent (16 in Ireland; 13 in the UK; varies elsewhere in the EU) — are not subject to any tracking or profiling on the platform.
For more on how we protect pupils' data generally, see Section 9 of our Privacy Policy.
9. Where this fits
This Cookie Policy sits inside our broader data-protection commitments:
- Privacy Policy — what personal data we hold, why, and your rights
- Sub-processors — the third parties we engage to deliver the platform
- Terms of Service — the contract under which schools subscribe
10. Changes to this policy
When we make a material change — adding a new cookie, introducing analytics, changing a retention period — we will:
- Publish the updated policy at skilly.ie/cookies
- Update the version-history table below with the date and a description
- Surface a notice on the next sign-in for affected users where the change directly affects them (for example, the appearance of a consent banner)
Non-material changes (typographical fixes, link updates) are published with a bumped version number but without notification.
11. Contact
For questions about this Cookie Policy or about how we handle data more generally:
📧 legal@skillysolutions.com 📞 +353 87 418 8829 📮 Data Protection · Skillscan Limited · 5 Kinross, Fey Yerra Lane, Leopardstown Road, Foxrock, Dublin 18, Ireland
You also retain the right to lodge a complaint with the Data Protection Commission (Ireland) at www.dataprotection.ie or with the Information Commissioner's Office (UK) at ico.org.uk.
Version history
| Version | Date | Summary |
|---|---|---|
| 2.0.1 | 7 June 2026 | Enabled Vercel Web Analytics on the public marketing pages only — cookieless, aggregate-only, no personal data, no consent banner, never on the signed-in platform. Updated Sections 4 and 6 accordingly. No new cookies; the cookie tables are unchanged. |
| 2.0.0 | 22 April 2026 | First standalone Cookie Policy. Replaces the cookie language that was embedded in the 1 October 2019 Privacy Policy. Documents the three currently-set cookies, confirms the no-tracking baseline, and commits to a self-hosted privacy-first analytics path if and when the time comes. |
| 1.0.0 (in Privacy Policy) | 1 October 2019 | Original cookie language (within Privacy Policy) — superseded. |