Cookie Policy
Last updated: 2026-07-25
This Cookie Policy explains how Linuxlab ("Linuxlab," "we," "us," or "our") uses cookies and similar browser storage on Linuxlab.io and its related subdomains (together, the "Site"). It also tells you exactly which cookies we set, why, how long they last, and how you can control them.
This document is written to match what the Site actually does. Linuxlab uses five cookies: three that the Site needs in order to work, and two set by Google Analytics, which measures how the Site is found and used. There are no advertising cookies and no marketing pixels, and Google's advertising features are switched off in our configuration. Section 5 explains what Google Analytics collects, and section 7 tells you how to opt out of it in one click.
This is an informational notice, not a consent form. Read section 8 for how we treat the analytics cookies and why the Site shows a notice rather than a consent banner.
1. What cookies are
Cookies are small text files that a website stores in your browser. When you return to the site, your browser sends the cookie back, which lets the site recognize your session and remember choices such as your language.
We also use two related technologies that are not cookies but that some people think of as "cookies":
- Local storage ("localStorage") is a small store inside your browser that a site can read and write. Unlike a cookie, it is never automatically sent to a server. We use it to remember a few preferences on your device.
- Server-side session storage holds short-lived data on our own servers, not in your browser. We use it for the interactive sandbox. It is not a cookie and nothing about it is stored on your device.
We describe all three below so you have the full picture.
2. Summary of what we use
- Five cookies. Three are strictly necessary: they keep you signed in and remember your language. Two belong to Google Analytics. You can refuse the Google Analytics pair and every part of the Site keeps working.
- A few localStorage keys on your device for functional preferences, such as your light or dark theme.
- Our own usage analytics, which use no cookies at all. They are first-party, store no raw IP address, and honor the Do Not Track and Global Privacy Control browser signals.
- Google Analytics 4, used to see how the Site is found and which pages are read, with Google Signals and ad personalization switched off. No advertising network, no Meta pixel, no remarketing.
3. The cookies we set
3.1 Strictly necessary
The three cookies below are first-party (set by Linuxlab, not by an outside company) and strictly necessary for the features you ask for. You cannot turn them off within the Site and still use the feature they support, because they are the feature. You can still remove or block them through your browser (see section 7), with the effects noted.
| Cookie | Type | Purpose | Flags | Duration | How to control it |
|---|---|---|---|---|---|
ll_session | Strictly necessary — authentication | Keeps you signed in. Its value is your opaque session token, which is a secret. Without it you cannot stay logged in. | HttpOnly; Secure (on staging and production over HTTPS); SameSite=Lax; Path=/ | 14 days (1,209,600 seconds), sliding — it refreshes while you stay active. Cleared when you log out. | Sign out to clear it, or delete cookies in your browser. Removing it signs you out. |
ll_locale | Strictly necessary — language preference | Remembers whether you chose Russian or English. Holds no personal data and no secret. | Not HttpOnly (the language switcher reads it); Secure over HTTPS; SameSite=Lax; Path=/ | 365 days (31,536,000 seconds) | Delete cookies in your browser. The Site will fall back to detecting your language again. |
ll_locale_src | Strictly necessary — language preference | Records whether your language was set by an explicit choice or by an automatic guess, so an automatic guess never overrides a choice you made on purpose. Holds no personal data and no secret. | Not HttpOnly; Secure over HTTPS; SameSite=Lax; Path=/ | 365 days (31,536,000 seconds) | Delete cookies in your browser. |
3.2 Analytics (Google Analytics 4)
Google Analytics runs on the Site and sets the two cookies below from JavaScript on the page. They are stored under the Linuxlab.io domain, but the measurement data they support is processed by Google. Neither one is necessary: block or delete them and every feature of the Site still works, exactly as before.
| Cookie | Type | Purpose | Flags | Duration | How to control it |
|---|---|---|---|---|---|
_ga | Analytics — Google Analytics 4 | Tells one browser apart from another so that a second visit is not counted as a second person. Its value is a randomly generated id. It holds no name, no email address, and no account identifier. | Not HttpOnly; Secure over HTTPS; SameSite=Lax; Path=/ | 2 years (63,072,000 seconds) | Block or delete cookies in your browser, or install Google's opt-out add-on (see section 7). |
_ga_DTZ325Z0L2 | Analytics — Google Analytics 4 | Holds the visit (session) state for our specific Google Analytics property. The suffix is our public measurement id, G-DTZ325Z0L2. | Not HttpOnly; Secure over HTTPS; SameSite=Lax; Path=/ | 2 years (63,072,000 seconds) | Same as _ga. Refusing it only stops the measurement. |
We set no other cookies. In particular:
- There is no advertising, marketing, or remarketing cookie. Google's advertising features (Google Signals and ad personalization) are switched off in our configuration, so your visit is not added to a cross-site advertising profile.
- There is no separate CSRF cookie. We protect form submissions with a stateless origin check and signed request nonces, not a cookie.
- The interactive sandbox sets no cookies. It authenticates each connection with a single-use ticket in the connection URL, not with your session cookie.
4. Browser storage on your device (not cookies)
The following items live in your browser's localStorage. They stay on your device, are never sent to our servers automatically, and hold no advertising or tracking data. You can clear them at any time through your browser's site-data controls.
| Key | What it stores | Why |
|---|---|---|
ll_theme | light or dark | Remembers your chosen display theme. |
ll_vid | A random visitor id used by our cookie-free usage analytics | Lets us count unique visits without a cookie and without your identity. It is suppressed and sent as empty when your browser signals Do Not Track or Global Privacy Control. See section 5. |
ll_cookie_notice | accepted | Remembers that you dismissed the one-time cookie notice, so we do not show it again. This is why the notice needs no consent: the dismissal itself is a local preference, not a cookie. |
ll:lesson-done:<lesson> | 1 per finished practice lesson | A per-browser hint of which hands-on lessons you have completed. |
5. Analytics
We measure aggregate usage of the Site so we can improve it. Two different systems do that, and it is worth knowing which is which.
5.1 Our own analytics (cookie-free)
This is the system the operator dashboards read. It is unusual in a good way:
- It does not use cookies. The optional visitor id lives in localStorage (
ll_vid), not in a cookie. - It stores no raw IP address. Where a visitor identifier is needed and no
ll_videxists, the server derives it by one-way hashing of connection details. The raw IP address is used only as an input to that hash and is never stored. - It is first-party only. Nothing it records is shared with an outside advertising or analytics company.
- It honors Do Not Track and Global Privacy Control. If your browser sends the Do Not Track signal or the Global Privacy Control signal, we drop the visitor identifier entirely. The recorded page view is fully de-identified — no account link, no visitor key, no per-visitor counter.
- It strips sensitive parts of the URL. Query strings and page fragments are removed before storage, and any referring site is recorded as a bare host, never a full address.
If you are signed in and your browser does not send a Do Not Track or Global Privacy Control signal, a page view may be linked to your account for product analytics. Under Do Not Track or Global Privacy Control, that link is not made.
5.2 Google Analytics 4
We also run Google Analytics 4 (measurement id G-DTZ325Z0L2) to see how people find the Site and which pages they read. Here is what that means in practice:
- What it sets. The two cookies in section 3.2, and nothing else.
- What it collects. The address of the page you view, the address that referred you, an approximate location (country and region) that Google derives from your IP address, your device and browser type, and events such as page views and how long a visit lasted. Google Analytics 4 does not log or store IP addresses.
- Advertising features are switched off. Google Signals and ad personalization signals are disabled in our configuration. Your visit is not used to build a cross-site advertising profile, and we run no remarketing or advertising audiences.
- Where we do not load it at all. Google Analytics is not loaded in the operator panel, nor on the links that carry a one-time token, such as email verification and password reset. Those addresses never reach Google.
- It does not act on Do Not Track. The Do Not Track and Global Privacy Control signals control our own analytics in section 5.1. Google Analytics ignores them, which is why section 7 gives you a direct way to switch it off.
Google processes this data under its own terms as our analytics provider. See Google's privacy policy and how Google uses data from sites that use its services.
6. Third-party embeds (video and terminal casts)
Some lessons embed video or recorded terminal sessions. We use privacy-forward embed sources on purpose:
- YouTube in "no-cookie" mode (
youtube-nocookie.com). This mode defers setting any cookie until you actively press play on a video. If you never play the video, it sets no cookie. - asciinema for recorded terminal casts.
When you play an embedded video or cast, the embed provider may set its own cookies under its own policy, which we do not control. If you do not interact with an embed, these providers set nothing.
These embeds set nothing until you press play. Their handling of any data is governed by their own policies: YouTube and asciinema.
Apart from these interaction-gated embeds, the only third-party service that sets cookies through the Site is Google Analytics, described in sections 3.2 and 5.2.
7. How to control cookies
You are always in control of cookies at the browser level.
- Opt out of Google Analytics with Google's opt-out browser add-on, which switches Google Analytics off on every site you visit, not only this one. Blocking cookies for the Site, or blocking
googletagmanager.comin a content blocker, has the same effect here. Nothing on the Site changes when you do it. - Sign out to clear your
ll_sessionauthentication cookie immediately. - Delete cookies and site data for Linuxlab.io in your browser settings to remove all five cookies and the localStorage items in section 4.
- Block cookies for the Site in your browser. Note the effect: blocking the strictly necessary cookies in section 3.1 will stop you from staying signed in and will stop the Site from remembering your language. The rest of the Site still works, and blocking the analytics cookies in section 3.2 changes nothing you can see.
- Turn on Do Not Track or Global Privacy Control in your browser to have our own analytics fully de-identify your page views (see section 5.1). Google Analytics does not act on those signals, so use the opt-out above for it.
Browser instructions:
On mobile, you can manage cookies and site data in your browser app's settings, and clear website data in your device's browser or Safari settings.
We set no advertising cookies, so there is no ad-network opt-out to perform and no "Do Not Sell or Share" link to click. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. The Google Analytics opt-out above is available to you all the same.
8. Why we show a notice, not a consent banner
We show a short, one-time informational notice, not an interactive consent banner. Here is the reasoning, stated plainly so you can judge it for yourself:
- Three of the five cookies are strictly necessary — your sign-in session and your language choice. They keep the service working and reflect a choice you made, so they do not require prior consent.
- The other two belong to Google Analytics, which we use to measure traffic with Google's advertising features switched off. The Site is written for United States law, where measurement of this kind is handled by notice and opt-out rather than by prior opt-in: we tell you it is running, and section 7 shows you how to switch it off in one step.
- We run no advertising, marketing, or remarketing cookies, and we do not sell or share personal information.
- Our own analytics, described in section 5.1, still use no cookies and still honor Do Not Track and Global Privacy Control.
A granular accept/reject banner would suggest that more is at stake here than actually is. The notice tells you what is happening and links here, where the opt-out is one click away.
9. Changes to this policy
We may update this Cookie Policy from time to time, for example if we add a feature that changes which cookies we use. When we make a material change, we will update the "Last updated" date at the top and, where appropriate, note the change on the Site. Continued use of the Site after an update means you have seen the current version. We encourage you to review this page periodically.
10. Contact
If you have questions about this Cookie Policy or how we use cookies:
- Signed-in users can reach us through the feedback form inside your account ("Write from your account").
- Linuxlab is operated by Automation and Progress LLC.
For how we handle personal data more broadly, see our Privacy Policy. This Cookie Policy is part of, and should be read together with, that Privacy Policy.