Last updated: October 4, 2026
Effective date: October 4, 2026
Our Privacy Policy explains how Lecture Hat, Inc. collects, uses, and stores information. This policy explains the cookies and similar device-storage technologies we use, where we use them, and the choices you have to control them. It covers our websites and web applications at https://lecturehat.com and https://askcactus.com, including their subdomains (collectively, the "Web Services"). It also describes local storage in our applications and Extension where relevant; native applications do not use every browser item listed below.
Cookies are small pieces of data stored on your computer or another device when a website loads in a browser. They remember you and your preferences for one visit (a session cookie) or repeated visits (a persistent cookie), and allow functions such as remaining signed in. First-party cookies are set by the site you visit; third-party cookies are set by another provider. Local storage, session storage, and IndexedDB also store data on the device, but do not send it with every HTTP request. We call these technologies "Cookies" in this policy.
We use Cookies for different purposes. Some are necessary for technical reasons, including sign-in and request security. Others remember preferences, retain drafts and unsent edits, or apply a referral you requested. Some are set when a page loads, and others when you sign in, choose a setting, or use a feature. The tables describe the current application inventory; provider names, defaults, and lifetimes can vary by browser or provider configuration.
The category labels explain function; they do not by themselves determine whether consent is legally required. Where applicable law requires consent for storing or accessing information on a device, it must be obtained before that use. A legal basis for processing personal information under GDPR is separate from any cookie-consent requirement.
These support requested functions such as signing in, protecting a request, completing an authentication handoff, and processing a payment. You can block them in your browser, but the affected function may fail. Provider security and checkout cookies are set only when the corresponding provider feature is used.
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| __session, __client_uat, __client | HTTP cookies. __session: Secure, SameSite=Lax, readable by Clerk’s browser SDK (not HttpOnly); __client_uat: Secure, SameSite=Lax, readable by the browser (not HttpOnly); __client: HttpOnly, Secure, SameSite=Lax | Clerk (identity provider) | Keeps you signed in. __session carries the short-lived session token used to authenticate requests to our backend; __client_uat records when your authentication state was updated; __client identifies your browser to Clerk. Demo access uses the same session cookie and sets no separate demo cookie. | Clerk-managed. Session tokens are short-lived and refreshed during an active session; cookie lifetime depends on Clerk and browser configuration |
| csrf-token | HTTP cookie (HttpOnly, Secure, SameSite=Strict) | First-party | Protects against cross-site request forgery on form and API submissions. | 24 hours |
| __Host-lh_desktop_auth | HTTP cookie (HttpOnly, Secure, SameSite=Lax) | First-party | Binds a desktop-application sign-in handoff to the browser that started it. | 5 minutes |
| cf_clearance, __cf_bm | HTTP cookie | Cloudflare (security and DDoS protection) | Distinguishes humans from bots and shields the Web Services from abusive traffic. | Cloudflare-managed; challenge clearance depends on the site configuration; __cf_bm normally expires after 30 minutes of inactivity |
| cf-turnstile-* | Token | Cloudflare Turnstile | A challenge token used in place of a CAPTCHA when you submit a support or contact form. | A few minutes |
| __stripe_mid, __stripe_sid | HTTP cookie | Stripe (payment processor) | Set by Stripe on Stripe’s own checkout and billing pages to detect payment fraud. These are not set on lecturehat.com or askcactus.com. | __stripe_mid: 1 year; __stripe_sid: 30 minutes |
These providers set their cookies under their own privacy policies: Clerk, Stripe, and Cloudflare. The vendors that process data on our behalf are identified in our Subprocessor List.
These support the personalized experience you request: settings persist between sessions, documents can reopen at the previous tab, and local drafts or offline edits can survive a refresh. Some entries can contain note, chat, transcript, or feedback content; they should not be treated as harmless simply because they are stored locally.
Browser local storage and session storage:
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| lh_ref, lh_ref_at | HTTP cookie (SameSite=Lax) and localStorage | First-party | Set only when you arrive through an invitation link from an existing user. Records that user’s referral code so the referral reward can be applied when you create an account. Not shared with any advertising network and not used for profiling. | Cookie: 30 days. Local storage: until the referral claim is processed during onboarding, you sign out, or you clear site data; abandoned local entries have no automatic 30-day expiry |
| lecture-hat-theme | localStorage | First-party | Stores your selected theme (light, dark, auto). | Persistent until you clear site data |
| lh_preferred_model, lh_thinking_level, lh_pilot_model | localStorage | First-party | Stores the AI model and response depth you last selected on each chat surface. | Persistent until you clear site data |
| lh-nb-* (for example lh-nb-editor-prefs, lh-nb-sidebar-dock, lh-nb-sidebar-width, lh-nb-history-width, lh-nb-zoom, lh-nb-page-view, lh-nb-margin-*, lh-nb-orient-<document id>, lh-nb-spacing-<document id>), lh-chat-style, lh-chat-auto-resize-enabled, lh-entity-colors, lh-ghost-text, lh-code-editor-theme, lh-vim-mode-enabled, lh-docs-smart-titles, lh-cad-chat-*, lh-project-chat-*, lh-upload-audio-to-transcripts, chatPopover_autoExpand, subtitlePosition, liveLecturePanelWidth, lh.mediaAudioSession.audioEnabled | localStorage; lh.mediaAudioSession.audioEnabled uses sessionStorage | First-party | Editor, viewer, and panel settings you have chosen. | localStorage settings persist until cleared; the sessionStorage audio setting lasts until the tab is closed or the setting is reset or cleared |
| notebook_<id>_tabs, notebook-active-section-<id>, notebook-<id>-last-tab | localStorage | First-party | Restores the tabs and the active panel of a notebook the next time you open it. | Persistent until you clear site data |
| askModal-draft-<id>, askModal-streaming-<id>, askModal-staged-<id>, lh.feedback.draft.v1, lh_blog_draft_*, lh-project-wal:* | localStorage | First-party | Keeps drafts, in-progress chat state, and unsynced project edits on your device so a refresh does not lose work. Chat state can include messages already sent to the Services and AI responses; local storage does not mean that content has never been transmitted. | Until the work is submitted, discarded, or you clear site data |
| lh:transcriptDraft:<notebook id>, lh:recordingActive | localStorage and sessionStorage | First-party | Auto-saves the live lecture transcript and marks that this tab was recording, so it can be recovered after a refresh or crash. | Transcript draft: used for up to 24 hours, then removed when next checked; also cleared when saved or discarded. Drafts are intentionally preserved across sign-out and checked against their account owner before recovery. Recording marker: until recording stops, sign-out clears session storage, or the tab closes |
| lecture-hat-query-cache, lh-smart-names-*, docsCache_<notebook id>_<folder id>, practiceSets_<notebook id> | localStorage | First-party | Caches recent successful API responses, generated document titles, document-list metadata, and practice-set state. | lecture-hat-query-cache: used for up to 24 hours, then removed when next checked; also removed after an application version change or sign-out. Document-list snapshots are usable for up to 5 minutes. Other entries persist until replaced, sign-out, or clearing site data; expiry of usability does not itself guarantee deletion of a stored value |
| tts_audio_<hash> | localStorage | First-party | Caches generated text-to-speech audio, keyed by a hash of the text, voice, and speed. | Used for up to 7 days, then removed when next requested; older entries may be evicted earlier to keep the cache within 2 MB; cleared on sign-out or when you clear site data |
| lh_last_user_id | localStorage | First-party | Detects that a different user has signed in on this device, so the prior user’s cached data is cleared. | Persistent until sign-out |
| lh_pending_invite_token | localStorage | First-party | Retains a class-invitation token across the sign-in flow so enrollment completes after account creation. | Cleared on successful enrollment |
| notebook-tutorial-completed, notebook-tutorial-seen, class_settings_intro_dismissed, lh.sonnet_warning_dismissed, lh-reel-open-confirm-dismissed, lh_dev_log_dismissed_<id>, lh.usage_threshold_<threshold>_<week>, lh.standard-terms-ack.v1 | localStorage | First-party | Records that you completed the in-product tutorial, dismissed a notice, or acknowledged a set of terms, so the same prompt is not shown again. | Persistent until you clear site data |
| lh_pilot_research_optin | localStorage | First-party | Carries your optional research opt-in through Pilot sign-in until it is recorded for the joined class. | Used for up to 2 hours, then removed when next checked; also removed after the replay attempt, if you opt out, or when you clear site data |
| lh-lesson-position:<user id>:<lesson id> | localStorage | First-party | Keeps account-scoped narrated-lesson playback position and progress, including progress awaiting synchronization to the Services. | Until replaced, sign-out clears local storage, or you clear site data |
| lh_oauth_consent_pending | localStorage | First-party | Carries the fact that you accepted the standard terms through Google sign-in until it can be recorded against your authenticated account. | Used for up to 30 minutes, then removed when next checked; also removed after the consent replay, sign-out, or clearing site data |
| authRedirectPath, returning_to_home, lh_chunk_reload_attempted | sessionStorage | First-party | Stores the page you were trying to reach so you can be returned there after sign-in, and records a single automatic reload attempt when a stale application file fails to load. | Session (until the tab is closed) |
Browser IndexedDB stores:
| Name | Type | Set by | Purpose | Duration |
|---|---|---|---|---|
| clerk-js | IndexedDB | Clerk (identity provider) | Clerk’s browser SDK can cache client and session state used by the sign-in flow. | Clerk-managed; clearing site data removes the local store |
| lh-lesson-audio-v1 | IndexedDB | First-party | Caches generated narrated-lesson audio and timing information using a hash that includes your account, lesson text, and voice, so playback can reuse audio. | Audio is usable for up to 30 days. Older entries are pruned on later cache writes, and entries can be evicted earlier to keep the cache within 80 MB. Sign-out attempts to delete this database; clearing site data also removes it |
| lh-offline-store | IndexedDB | First-party | Keeps local document copies, cached file data and API responses, and a queue of edits that have not yet reached our servers. It is retained after you sign out so unsynced edits are not destroyed. The application filters records by account when reading them; that is not encryption against someone who can inspect the browser profile or device storage. | Persistent until you clear site data |
We do not deploy a separate third-party marketing analytics SDK or analytics cookie to measure Lecture Hat service use. We still collect first-party request, error, usage, billing, and class-feature records as described in the Privacy Policy. Those records can measure service use without being an analytics cookie. Security, payment, and embedded-content providers can separately collect operational information when their resources load.
We do not set Lecture Hat advertising cookies or deploy our own retargeting or social-media pixels. We do not sell or share personal information for cross-context behavioral advertising. An embedded YouTube player can separately show non-personalized advertising as described below. A future change requiring consent must be disclosed and consent obtained before the affected processing.
Public blog posts can load YouTube players from youtube-nocookie.com, and the tutorial welcome image loads directly from Unsplash. Loading those resources sends the provider your IP address and browser request information, including referring-site information the browser permits. A video player can load before you press Play; its device-storage practices are governed by Google's cookie information. YouTube's privacy-enhanced mode limits personalization of viewing and advertising; it does not promise no data transmission or no ads. Unsplash's handling of direct image requests follows its Privacy Policy. Browser content-blocking and site-permission controls can restrict external resources; disabling them may prevent the image or player from working. An exemption or consent requirement for provider storage depends on the actual purpose and applicable law, rather than the player's domain name.
Our iPad and macOS desktop applications keep authentication context, local document copies, and unsent edits on the device. App deletion alone may not remove separately retained system credentials or app-container data; use the operating system’s app-data and credential controls as appropriate. The Lecture Hat Browser Extension, offered in the Chrome Web Store as Lecture Hat Study Companion, keeps consent, linked-course and import records, authentication context, and local Canvas state in Chrome. Removing the Extension clears its local extension storage; the two settings that use Chrome Sync are also governed by your Chrome and Google account controls. Clearing Lecture Hat website data does not clear Chrome extension storage or delete imported content from your Lecture Hat account. These applications and the Extension do not use advertising identifiers. See the Lecture Hat Browser Extension Privacy Policy.
You can restrict Cookies, prevent them from being set, or delete stored site data through your browser. If you disable required Cookies, some features may not function correctly. These choices usually apply only to that browser and device, so you may need to repeat them elsewhere. For instructions, see the help pages for Chrome, Firefox, Safari, or Edge.
The current Web Services have no general cookie-consent banner or consent-management platform. Available controls are the feature or permission choice, browser storage settings, and support requests. Clearing data does not necessarily stop a page from setting an item again when you reload it, and emailing support does not instantly block a browser write. To ask about or withdraw consent for a use that relies on it, use the relevant feature control or contact [email protected] with the subject "Cookie Consent Withdrawal." Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
We neither sell nor share personal information for cross-context behavioral advertising, nor use it for targeted advertising. A Global Privacy Control signal expresses an opt-out of sale or sharing where law recognizes it. Because we conduct neither, the signal produces no change in our processing. If we begin processing for which the signal is operative, we will honor it and update this Policy before doing so.
Some browsers transmit a "Do Not Track" signal. There is no accepted industry standard for interpreting that signal, and we do not respond to it. The current application does not build a cross-site advertising profile. This does not prevent a provider from processing the security or payment information needed for its own service under its policy.
You can clear website cookies and local website stores using your browser's "clear site data" control. Clearing site data while edits are queued offline will discard those edits. The offline document store and recoverable transcript drafts can remain after sign-out to protect unsynced work, so use clear-site-data controls before giving another person access to your browser profile. Extension storage and native application data require the separate controls described in Section 4.
The "Last updated" date at the top of this page reflects the most recent revision of this Cookie Policy. Material changes will be communicated as described in our Privacy Policy.
Questions about our use of Cookies may be sent to [email protected] or to Lecture Hat, Inc., 7710 SW 67th Ave, South Miami, FL 33143-4532, USA.
Template credit and reuse: Adapted from Automattic's Cookie Policy. Lecture Hat changed the service scope, cookie inventory, provider examples, local and offline storage, advertising practices, and controls. This adapted policy text is available under CC BY-SA 4.0. Automattic does not endorse Lecture Hat.