Cookie Policy
Effective Date: October 13, 2026
Last Updated: October 13, 2026
This Cookie Policy explains how END PEAK, S.L., operating under the brand ENDPEAK ("ENDPEAK," "we," "us," or "our"), uses cookies and similar technologies when you access or use our websites, applications, educational platform, and related services (collectively, the "Services").
This Cookie Policy should be read together with our Privacy Policy.
For information about how we collect, use, disclose, and protect personal information more generally, please review our Privacy Policy.
1. WHAT ARE COOKIES?
Cookies are small text files that may be stored on your browser or device when you visit a website or use an online service.
Cookies can perform different functions, including keeping users signed in, maintaining security, remembering preferences, measuring how a service is used, and supporting advertising or marketing activities.
Some cookies are deleted when you close your browser ("session cookies"), while others remain for a specified period or until deleted ("persistent cookies").
Cookies may be:
- first-party cookies, set by ENDPEAK; or
- third-party cookies, set by another organization whose technology is used through the Services.
2. SIMILAR TECHNOLOGIES
This Policy also applies, where appropriate, to technologies that perform functions similar to cookies, including:
- local storage;
- session storage;
- software development kits;
- pixels;
- tags;
- device or browser identifiers; and
- other technologies that store or access information on a user's device.
For simplicity, we may refer to these technologies collectively as "cookies" in this Policy.
3. HOW ENDPEAK USES COOKIES
ENDPEAK may use cookies and similar technologies for the purposes described below.
The specific technologies used may change as ENDPEAK develops its Services.
We periodically review the technologies used on the platform and update this Cookie Policy where appropriate.
4. STRICTLY NECESSARY COOKIES
Strictly Necessary cookies are required for ENDPEAK to operate properly or to provide functionality that you explicitly request.
They may be used for purposes such as:
- account authentication;
- maintaining login sessions;
- security;
- fraud prevention;
- protecting user accounts;
- maintaining application sessions;
- processing requested transactions;
- remembering privacy choices;
- load balancing; and
- providing other essential platform functionality.
Because these technologies are necessary to provide the Services you request, they generally cannot be disabled through ENDPEAK's cookie preference center.
Disabling them through your browser may prevent certain ENDPEAK features from functioning properly.
5. FUNCTIONAL AND PREFERENCE COOKIES
Functional or preference cookies may allow ENDPEAK to remember optional choices and provide enhanced functionality.
Depending on the implementation, they may remember preferences such as:
- interface settings;
- language preferences;
- display preferences; or
- other optional user choices.
Where applicable law requires consent for these technologies, they will not be activated until the required consent has been obtained.
6. ANALYTICS COOKIES
Analytics technologies may help ENDPEAK understand how users interact with the Services.
They may help us understand information such as:
- which pages or features are used;
- how users navigate ENDPEAK;
- general engagement patterns;
- technical errors;
- application performance;
- conversion activity; and
- how we can improve the Services.
Where applicable law requires consent, analytics technologies requiring consent will remain disabled until you choose to enable them.
7. ADVERTISING AND MARKETING COOKIES
ENDPEAK may use advertising or marketing technologies to understand the effectiveness of advertising campaigns and, where applicable, support relevant advertising.
These technologies may be used for purposes such as:
- campaign attribution;
- advertising measurement;
- conversion measurement;
- audience creation;
- retargeting; or
- measuring advertising effectiveness.
Certain advertising technologies may allow third-party advertising providers to recognize a browser or device across different websites or services.
Where applicable law requires consent, ENDPEAK will not activate advertising or marketing technologies requiring consent until you choose to enable them.
We do not intentionally provide advertising platforms with your detailed Q-Bank answers, individual CAT responses, detailed study history, AI conversation content, or individual ENDPEAK readiness scores for targeted advertising.
No advertising pixel or marketing-tracking SDK was identified in the current application. The preference category does not itself install advertising technology. A material vendor or purpose change requires a new consent version.
8. COOKIES AND TECHNOLOGIES CURRENTLY USED
ENDPEAK uses the cookies and similar technologies identified below. Names containing braces identify variable parts of a storage key. Local storage has no browser-enforced expiration unless the application implements one. Not every technology is used on every page.
| Name / Technology | Provider | Category | Purpose | First or Third Party | Duration |
|---|---|---|---|---|---|
| endpeak.cookie-consent (local storage) | ENDPEAK | Strictly Necessary | Remembers category choices, decision time, version, expiry and applicable ruleset. | First party | 180 days; replaced when you change your choice. |
| sb-{project-ref}-auth-token (local storage) | ENDPEAK / Lovable Cloud authentication | Strictly Necessary | Keeps your requested authenticated session available and refreshes authentication tokens. | First-party storage; authentication requests through Lovable Cloud | No local-storage expiry; updated by Auth and removed on sign-out. Token validity is managed separately by Auth. |
| device_id (local storage) | ENDPEAK | Strictly Necessary | Identifies an authenticated device for account security and concurrent-session controls. | First party | No automatic expiry in application code; until cleared. |
| Fingerprint Pro device identification; _vid (provider-documented cookie/local-storage key) | Fingerprint | Strictly Necessary — security only | Configured security integration for authenticated-session protection and trial-abuse detection, when a provider key is enabled. Not used for advertising or educational profiling. | First-party device storage; information sent to Fingerprint | Provider-controlled cookie expiry is not specified by this application. Local storage persists until cleared; no fixed duration is asserted. |
| mc:seen-questions:{userId} (local storage) | ENDPEAK | Strictly Necessary | Remembers questions already presented to support requested study and question-selection functionality. | First party | Until progress reset or browser storage is cleared. |
| mastercert:coach:paused-step:{userId}:{variant} (local storage) | ENDPEAK | Strictly Necessary | Resumes the onboarding tutorial you are completing. | First party | Until the tutorial is restarted/completed or storage is cleared. |
| chunk-reload:{pathname} (session storage) | ENDPEAK | Strictly Necessary | Prevents repeated reloads when recovering a failed application download. | First party | Browser tab session; removed on manual retry. |
| rag-ingest-errors:{certificateId} (local storage; administrators only) | ENDPEAK | Strictly Necessary | Retains import error information for an administrator’s requested content-import operation. | First party | Until errors are cleared/resolved or storage is cleared. |
| mc-theme (local storage) | ENDPEAK | Functional | Remembers your optional light/dark appearance preference. | First party | Until consent withdrawal or browser storage is cleared. |
| mastercert.activeCertificateId; exam-sim:certificate (local storage) | ENDPEAK | Functional | Remembers the selected certificate. The second key is a legacy preference read by the application. | First party | Until consent withdrawal or browser storage is cleared. |
| mc:admin-mode; mc:admin-force-onboarding; admin-modules-open:{certificateId} (local storage) | ENDPEAK | Functional | Remembers administrator interface preferences; these keys do not grant administrator permissions. | First party | Until consent withdrawal or browser storage is cleared. |
| studyPlanChangeSeen:{notice}; rec-done:{userId}:{action} (local storage) | ENDPEAK | Functional | Remembers optional feature notices and dismissed/completed recommendations. | First party | Until consent withdrawal or browser storage is cleared. |
| chat-visited (session storage) | ENDPEAK | Functional | Remembers whether the chat greeting has been shown in this tab. | First party | Browser tab session, or earlier consent withdrawal. |
| sidebar_state (cookie) | ENDPEAK | Functional | Remembers sidebar display state. | First party | 7 days, or earlier consent withdrawal. |
| session-id (cookie); page-view requests to /~api/analytics | ENDPEAK / Lovable (Tinybird analytics) | Analytics | Measures visits and navigation only after Analytics is enabled. Query strings, fragments and user UUIDs are excluded from page URLs. | First-party cookie and endpoint; analytics processed by hosting provider | Cookie: 30 minutes from the most recent tracked page view, or earlier withdrawal. |
| Mux Data (playback telemetry) | Mux | Analytics | Measures playback quality/engagement only after Analytics is enabled. Mux cookies and remembered volume/mute/subtitle preferences are disabled in this integration. | Third-party analytics requests | Active player instance; no persistent Mux cookie is enabled by this integration. |
The authentication SDK may also use temporary authentication-flow storage where required by a requested sign-in or recovery flow. These are authentication technologies, not advertising identifiers.
Video delivery by Mux is separate from optional Mux Data analytics. Playback can operate when Analytics is rejected. Volume, mute and subtitle settings remain available within the current player, without persistent preference storage. Legacy Mux muxData cookies and media-chrome-pref-volume, media-chrome-pref-muted and media-chrome-pref-subtitles-lang local-storage preferences controlled by ENDPEAK are removed by the current privacy implementation.
The application loads Google Fonts for typography and may load jsDelivr player resources, an unpkg PDF worker for a requested PDF operation, and Sanity content resources. These are resource-delivery integrations, not entries asserted to be tracking cookies. Resource providers receive the technical request information necessary to deliver their resources.
AI processing, transactional email and backend database operations do not become browser cookies merely because providers such as OpenAI, Resend, or Lovable Cloud supply those services.
9. THIRD-PARTY SERVICES
ENDPEAK uses third-party technology providers to operate certain aspects of the Services.
Depending on the feature and technical implementation, providers may include services relating to:
- authentication;
- cloud infrastructure;
- payments;
- video;
- analytics;
- security;
- communications;
- advertising; and
- other technical functions.
Some third-party providers may place or access cookies or similar technologies when their functionality is used.
Where required by applicable law, technologies that are not strictly necessary will not be activated until the appropriate consent has been obtained.
Third-party technologies may also be governed by the privacy and cookie policies of the relevant provider.
10. PAYMENT TECHNOLOGIES
ENDPEAK may use third-party payment providers to process purchases and subscriptions.
Payment providers may use technologies necessary to:
- process payments;
- prevent fraud;
- authenticate transactions;
- protect payment systems; and
- comply with legal obligations.
Certain technologies used directly by a payment provider may be governed by that provider's own privacy and cookie practices.
The current application integrates Paddle Checkout on a requested purchase action. Stripe browser cookies are not listed because no Stripe browser integration was identified in the current application. Cookies within an independently controlled checkout are governed by the payment provider; this policy does not assert unverified cookie names or durations for that checkout.
11. COOKIE CONSENT IN EUROPE
If you access ENDPEAK from a jurisdiction where consent is required before using certain non-essential cookies or similar technologies, ENDPEAK will request your permission before activating those technologies.
You may be given the ability to:
- Accept All optional cookies;
- Reject Non-Essential cookies; or
- Manage Preferences by category.
Rejecting optional cookies will not prevent you from using core ENDPEAK functionality.
Strictly Necessary technologies may continue to operate because they are required to provide the Services you request.
ENDPEAK applies this experience to the EEA, United Kingdom and Switzerland. When a reliable country signal is unavailable, the same protective experience applies. ENDPEAK does not request precise location for this purpose. Scrolling, navigation, inactivity and closing a preference panel are not consent.
12. MANAGING YOUR COOKIE PREFERENCES
You may change your choices at any time by selecting Cookie Settings from the ENDPEAK website or application footer.
Changing your preferences does not affect the lawfulness of processing that occurred before your consent was withdrawn.
When you withdraw consent, ENDPEAK will stop using the applicable consent-dependent technologies for future activity as required by applicable law and subject to technical limitations concerning technologies controlled independently by third parties.
ENDPEAK removes the optional first-party storage it controls for disabled categories. It does not claim to erase third-party cookies that browsers prevent ENDPEAK from accessing, or undo information already transmitted before withdrawal.
13. BROWSER CONTROLS
Most web browsers allow you to manage cookies through browser settings.
Depending on your browser, you may be able to:
- view cookies;
- block cookies;
- delete cookies;
- block third-party cookies; or
- configure when cookies may be stored.
Blocking all cookies, including Strictly Necessary cookies, may prevent ENDPEAK from functioning correctly.
Browser controls are separate from ENDPEAK's cookie preference center.
14. GLOBAL PRIVACY CONTROL AND OTHER PRIVACY SIGNALS
Certain browsers and extensions may transmit privacy preference signals, such as Global Privacy Control ("GPC").
Where ENDPEAK is legally required to recognize a supported privacy preference signal, we will process that signal in accordance with applicable law. In this implementation, a detected GPC signal keeps Advertising & Marketing disabled.
For additional information about privacy rights and choices, please review our Privacy Policy.
15. INTERNATIONAL PROCESSING
Some providers used by ENDPEAK may process information in countries different from the country where you reside, including the United States.
Where personal information is transferred internationally, ENDPEAK uses appropriate safeguards where required by applicable data protection law.
For additional information regarding international data transfers, please review our Privacy Policy.
16. HOW LONG COOKIE PREFERENCES ARE STORED
ENDPEAK stores your cookie preferences so that we do not repeatedly ask you to make the same choice on every visit.
We may request that you renew your preferences periodically or when:
- our use of cookies materially changes;
- the purposes for which technologies are used change;
- important third-party providers change;
- new categories of tracking are introduced; or
- applicable legal requirements change.
The current choice expires after 180 days, which is shorter than 24 months. Material changes require a new consent version. An expired, invalid or outdated record does not authorize optional technologies. Changing your choice immediately replaces the previous choice.
If browser storage is unavailable, your choice can apply to the current page but may not persist for a future visit.
17. CHANGES TO THIS COOKIE POLICY
We may update this Cookie Policy from time to time to reflect:
- changes to the ENDPEAK Services;
- changes to technologies or providers;
- changes to our use of cookies;
- legal or regulatory developments; or
- changes to our privacy practices.
When we update this Policy, we will update the "Last Updated" date.
Where required by law, material changes affecting consent-dependent technologies may require us to ask you to make a new cookie choice.
18. CONTACT US
If you have questions about this Cookie Policy or ENDPEAK's use of cookies and similar technologies, contact:
END PEAK, S.L.
Operating as ENDPEAK
Camí Nou de Picanya, 31, Escalera Izquierda, Puerta 2
46014 Valencia
Spain
Privacy: contact@endpeak.com
Support: contact@endpeak.com
Website: https://endpeak.com
© 2026 END PEAK, S.L. All rights reserved.