Cookie policy

What cookies are

Cookies are small text files stored on your device. I also use similar browser storage (localStorage, which stays until you clear it, and sessionStorage, which ends when you close the tab) to remember your cookie choices and the features listed below. This page lists every cookie and every storage key the site sets, and what each one is for.

The ESAT and TMUA practice account runs on the same software on lucasrey.com and on mintnib.com/account/, so the cookies and storage listed under the practice account are set in the same way on both sites.

How consent works

On your first visit you can accept all cookies, reject non-essential cookies, or choose by category. You can change your mind anytime using Manage cookies in the site footer.

Categories

Strictly necessary (always on)

Required for security, signing in, cookie preferences, basic site operation, and the features you choose to use. No consent needed. Nothing here is used for advertising, and nothing here is read by anyone but this site.

On every page

  • lr_cookie_prefs_v1 (localStorage): stores your cookie choices.
  • lr_pass_strip_closed (localStorage): set only if you close the free account strip, so it stays closed on later pages.

Timed papers and the diagnostic

  • lr_esat_diagnostic_v1, lr_tmua_diagnostic_v1, lr_pat_diagnostic_v1 and lr_mock_* (localStorage): if you start a diagnostic or a timed test, your answers and the time left are kept on your own device so you can close the tab and come back to the same attempt. They are set only once you press start, they are never sent anywhere, and clearing your browser storage removes them.
  • lr-test-gate-v1 (localStorage): the email address you gave to start a timed paper, and whether you ticked the newsletter box, so that you are asked once on this browser rather than before every paper.
  • lrDiagnosticCarry (localStorage): set only if you tap to take your diagnostic result into the practice account. It holds the score, the score for each module, your three weakest topics and the answers you gave, kept on your device so the practice account can show them; the practice account stops using it after 120 days.

Signing in to a practice account

  • lr_device and lr_device_sig (cookies): a random code that marks this browser as one of your account's devices, and a signature showing that the site made it. This is how an account is kept to its own devices. Readable by the server only; they last 400 days.
  • WordPress's sign-in cookies (wordpress_sec_ and wordpress_logged_in_, each followed by a code): keep you signed in. They last 14 days.
  • lr_google_state (cookie): set only when you choose to sign in with Google. A one-time code that ties Google's answer to the browser that asked for it. It lasts 10 minutes and is removed when the sign in finishes.
  • lr_apple_state and lr_apple_finish (cookies): the same for Sign in with Apple, lasting 10 minutes and 2 minutes, each removed when it has been used. Apple answers by sending a form from its own site, so these two are marked to be sent on that cross-site request; they are still sent only to this site.

Inside the practice account (all in localStorage unless marked otherwise). None of them holds your name or your email address. Where a key name ends in *, the end is the exam, a date, or a short code worked out from your account’s email address, so that two accounts used on one browser keep separate notes.

  • Your settings: lrPassTheme (light or dark), lrPassReading (the clearer font and larger text), lrPassClockHidden (whether the clock is shown), lrPassDrillLength, lrPassDrillLevel and lrPassLevel (the length and level you chose for drills and papers), lrPassExtraTime (the extra time you chose for papers), lrPassPaperPlan (the time you planned to sit your paper) and lr_mental_maths (your mental maths progress, which is kept on your device and never sent).
  • lrPassTree and lrPassTree:*: a copy of the public syllabus list, so the Syllabus tab opens without waiting. It holds nothing about you.
  • Reminders: lrPassNotifyOn (a code made from your account, not your account itself, so the page knows reminders are on for it), lrPassNotifySnooze (until when you asked not to be asked again), lrPassNotifyIosHint, and in sessionStorage lrPassNotifyChecked and lrPassNotifyShown.
  • Notes that stop the page repeating itself: lrPassTesterBarClosed, lrPassTrialEndClosed, lrPassSoonClosed, lrPassConfetti, lrPassHeldAsked, lrPassTrialStatsSeen:*, lr_seen_version:* (the last “new on” note you saw), lr-pass-lastweek-* (the last weekly summary shown), lr-pass-map-* (how your topic map looked when you last saw it, so the next look can show what moved), and in sessionStorage lr-pass-first-q-later and lr-pass-first-open.
  • A choice carried through sign up or a checkout: lrPassPlan and lrPassSet (the plan or question set you picked before making an account), lrPassUnlockFrom (where the checkout was opened from) and lrPassPayStarted (when you came back from a payment, so the page can wait for it to arrive).
  • lrPassDeviceCopy: a code worked out from this device's code (not the code itself), handed over once, sent back only with the tap that starts the free 24 hours, so that the free time is given once per device.
  • lr-pass-account: an older version of the page kept a note here. The page no longer writes it, and removes it when it finds it.

Asking for a free pass

  • lr_give_self (cookie): set when you send a request for a free pass, so the same browser does not ask again within 30 days. It holds the value 1 and nothing about you; it lasts 30 days.

Password-protected pages

  • WordPress’s wp-postpass_ cookie, followed by a code: set when you type the password of a protected page, such as a school’s private page, so that the page stays open on this browser. It holds the password in hashed form, not as typed, and lasts 10 days.

The private booking portal (for invited students)

  • lr_book_lang (cookie): set only if you choose the portal's language, or open a link that names one, so the portal stays in that language on this browser. Sent only to the booking page; it lasts one year.
  • lr_booking_view_tz (localStorage): the time zone you chose to see lesson times in.
  • lr_booking_bookmark_dismissed (sessionStorage): you closed the reminder to bookmark your portal link.
  • lr_booking_portal_token (sessionStorage): an older version of the portal kept your portal link's code here. The portal no longer writes it, and removes it when it finds it.

Functional

Improve forms and security. I do not currently use any functional cookies; this category is available for future tools and remains off unless you enable it.

Analytics

Help me understand site usage through Google Tag Manager (GTM-MT7BPBB4) and related tags. Enabled only with your consent. With that consent, Google Analytics sets its own cookies, _ga and _ga_ followed by a code.

With that consent, I also set lr_ga_cid, a first-party cookie that lasts one hour. It carries the Google Analytics client id to my own server, so that a checkout and a purchase are counted with the visit that led to them. Without your consent it is not set, and if you withdraw consent it is removed, or lapses within the hour.

With that consent, two keys in localStorage also count, as numbers only, which pages and messages lead somewhere. Without your consent neither is written:

  • lrPassTrialRef: the name of the page whose free trial link you followed, for 30 days. It is sent with the tap that starts a free trial, so that I can count how many trials each page starts, as numbers only, and it is removed once a trial has started.
  • lr-pass-sv-*: one key a day for each kind of message strip shown at the top of the practice account, so that each is counted at most once a day, as a number only.

Marketing

Promotional or remarketing tools from third parties. I do not currently use marketing cookies; this category is available for future tools and remains off unless you enable it.

An invite you followed

One key in localStorage carries out an invite you followed. It holds nothing about you:

  • lr-pass-invite-v1: the invite code in a friend’s link, so that the invite you followed counts when you make your account. Kept for 30 days, and removed once it has been used.

Managing cookies in your browser

You can block or delete cookies and site storage in your browser settings. Strictly necessary storage may still be required for the site to remember your consent choice, and blocking the sign-in cookies means you cannot stay signed in.

More information

See the privacy policy for how I handle personal data.

Last updated: 31 October 2026.