Cookie Policy
The cookies and similar technologies we use, and how to control them.
Version 1.0 · In effect from 15 October 2026 · Last updated 25 October 2026 · Current page
1. What this Policy covers
1.1 This Policy explains the cookies and similar technologies we use on Lemma, what each is for, and how you control them. It forms part of the Privacy Policy.
1.2 Lemma is operated by SkillSwap Ltd, trading as Lemma, Larnaca, Cyprus (details in the Legal Notice). Questions about this Policy: privacy@getlemma.io.
2. The technologies we use
The law here is not about "cookies" as such: it covers any storing of information on your device, or access to information already stored there (ePrivacy Directive 2002/58/EC, Art. 5(3)). Following EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), that includes all of the following, and we treat them identically:
2.1 Cookies — small text files a site stores in your browser and reads back later. 2.2 Local storage and session storage — key-value data held in your browser, used to keep you signed in and remember interface state. 2.3 IndexedDB — a larger in-browser store; our sign-in provider (Google Firebase) uses it to keep you signed in. 2.4 Pixels and tracking URLs — tiny images or link parameters that tell a sender a message was opened or a link followed (see 4.5). 2.5 Scripts and SDKs loaded from our providers, for example the live-video component. Payments take place on Stripe's own checkout page, under Stripe's cookie policy. 2.6 Device fingerprinting — combining device and browser characteristics into an identifier. We do not use device fingerprinting. Security checks such as rate limiting use the IP address of each request on our servers and read nothing from your device.
2.7 Users in the United Kingdom. The same consent rules apply to you under the Privacy and Electronic Communications Regulations 2003, regulation 6, as amended by the Data (Use and Access) Act 2025. We do not rely on the new UK exemption for statistical analytics: PostHog is still set only with your consent.
3. The consent rule we apply
3.1 Only strictly necessary technologies are set without your consent. "Strictly necessary" means needed to deliver the service you asked for — signing you in, keeping your Session connected, taking a payment, remembering your cookie choice. It does not mean useful to us.
3.2 Everything else — functional extras, analytics and any marketing technology — is set only after you opt in, by an affirmative act (GDPR Arts. 4(11) and 7).
3.3 Our banner meets these standards:
3.3.1 "Reject all" is presented as prominently as "Accept all" on the first layer — same level, same size, same visual weight, no greyed-out or hidden button. 3.3.2 Nothing non-essential is set before you choose, and closing the banner without choosing is treated as a refusal. 3.3.3 No pre-ticked boxes, no consent bundled with anything else, no "legitimate interest" toggles pre-enabled for purposes that need consent. 3.3.4 No deceptive design: no nagging repetition, no confusing wording, no button that looks like a refusal but is not (EDPB Guidelines 03/2022 on deceptive design patterns; and the prohibition of unfair commercial practices in Directive 2005/29/EC as transposed in Cyprus). 3.3.5 Refusing costs nothing. Lemma works without any non-essential technology, and refusal has no effect on your Sessions, Credits or SCI.
3.4 We ask again only if your stored choice expires (after 6 months) or if we introduce a new purpose. We do not re-ask on every visit to wear you down.
4. What we set, by category
The entries below come from our code for https://getlemma.io (the website) and https://app.getlemma.io (the app). We confirm them with a scan of both before each version of this Policy (see 10.1).
4.1 Strictly necessary — no consent required
| Name | Where | Purpose | Party | Duration |
|---|---|---|---|---|
__Host-ss_session |
App | Keeps you signed in (session cookie, set by our servers) | First party | 14 days, renewed while you use the app |
firebaseLocalStorageDb (IndexedDB) |
App | Sign-in state held by our authentication provider | First party (Google Firebase) | Until you sign out or clear site data |
lemma_consent (cookie on .getlemma.io, mirrored as lemma.consent in local storage) |
Website and app | Stores your cookie choice (analytics, marketing, date) so one choice applies to both and we can honour and prove it | First party | 6 months |
lemma_demo |
App | Shows the demo with sample data when you open the demo | First party | 1 hour |
lemma_tour, lemma.sidebar.collapsed (local storage) |
App | Remembers whether you finished the product tour and how you left the sidebar | First party | Until you clear site data |
ss_signup_profile_v1 (session storage) |
App | Keeps what you have entered in the sign-up steps if you reload the page | First party | Until you finish sign-up or close the tab |
lemma.shown_toast_ids (session storage) |
App | Stops the same notification pop-up appearing twice | First party | Until you close the tab |
lemma-assistant (session storage) |
Website | Keeps your conversation with the "Ask Lemma" assistant while the tab is open | First party | Until you close the tab |
blog-scroll:* (session storage) |
Website | Returns you to the same place in a blog list | First party | Until you close the tab |
The live-video connection for a Session runs over WebRTC and sets no cookie of its own.
4.2 Preferences you set — no consent required
These remember how you have set up the interface, and nothing else.
| Name | Where | Purpose | Party | Duration |
|---|---|---|---|---|
lemma-theme (local storage) |
Website | Remembers light, dark or system theme | First party | Until you clear site data |
theme, theme_pref (local storage) |
App | Remembers light, dark or system theme | First party | Until you clear site data |
NEXT_LOCALE |
App | Remembers your language | First party | Until you close your browser |
lemma.command.recent (local storage) |
App | Shows your recent searches in the command menu | First party | Until you clear site data |
lemma-locale (local storage) |
Website | Remembers your language | First party | Until you clear site data |
4.3 Analytics — consent required
Nothing in this category is loaded, and no analytics script is requested, until you switch on Analytics in the banner.
| Name | Where | Purpose | Party | Duration |
|---|---|---|---|---|
ph_<project>_posthog (cookie on .getlemma.io and local storage) |
Website and app | Pseudonymous identifier used to measure how the website and app are used, as one journey across both | PostHog (EU cloud) | 12 months |
| PostHog session replay | Website only | Recordings of page interactions used to find what confuses visitors. Everything typed into a field is masked and never recorded | PostHog (EU cloud) | Kept by PostHog for up to 90 days |
lemma.attribution.first (local storage) |
Website | The campaign, referring site or ad click that first brought you, attached to sign-up events | First party | Until you clear site data |
lemma_ft |
Website | The campaign link (its utm_ parameters), the referring site and the first page of the visit that first brought you, sent with an early-access sign-up so we can see which channels bring sign-ups |
First party | 30 days |
_ga, _ga_<container> (via Google Tag Manager) |
Website | Google Analytics 4 visit and conversion measurement | Google (Google Ireland Ltd; Google LLC) | Up to 2 years (Google's default) |
lemma.analytics.* (local and session storage) |
App | Remembers which product events have already been counted, and, until your account is created, the campaign link that brought you (Privacy Policy 2.20C) | First party | Product events: until you clear site data; campaign link: until the account is created or the tab is closed |
Google Tag Manager is loaded only after you allow Analytics or Marketing, and Google Consent Mode v2 is set to "denied" for every purpose before it loads, then updated to your choice.
4.4 Marketing — consent required (website only)
Set only if you switch on Marketing in the banner, and never in the app.
| Name | Purpose | Party | Duration |
|---|---|---|---|
_gcl_au, _gcl_aw (via Google Tag Manager) |
Measures whether a Google ad you clicked led to a sign-up; with Marketing on, Google may also use this to personalise ads | Google (Google Ireland Ltd; Google LLC) | 90 days |
We do not use these technologies for Users under 18 (Privacy Policy, clause 10.3).
4.5 Email
Our emails are sent through Resend. Open tracking and click tracking are switched off for our sending domain, so our emails contain no tracking pixel and their links are not rewritten: we do not know whether you open an email or click a link in it. Every email that is not essential to your account carries a link to your email preferences and to unsubscribe.
5. Analytics need consent — legitimate interests is not an option
Analytics are not strictly necessary. Storing or reading an analytics identifier on your device requires consent under ePrivacy Art. 5(3), and that specific rule displaces the general GDPR balancing exercise: we cannot rely on legitimate interests here, however carefully documented. If you refuse, we measure nothing about your visit beyond aggregate server-side counts that read nothing from your device. Two exceptions, which store nothing on your device either: if you join the early-access list, the campaign link, referring site and first page of that visit are sent with your sign-up and kept with it (Privacy Policy, 2.20); and when you follow a link from our website into the app, that link's address carries the same campaign values, which are recorded once if you create an account (Privacy Policy, 2.20C).
6. Changing your mind
6.1 Withdrawal is as easy as consent (GDPR Art. 7(3)). Use the Cookie settings link in the footer of every page of the website, or Settings → Account → Cookie settings in the app, to change any category at any time; one choice covers both. Withdrawing takes no more clicks than accepting did.
6.2 When you withdraw consent we stop setting that category immediately and delete or expire the identifiers already set, as far as we technically can. Anything a third party has stored may also need clearing in your browser.
6.3 Withdrawal has no effect on the lawfulness of what happened before it.
7. Browser and device controls
7.1 Every major browser lets you block or delete cookies and site data and offers a private-browsing mode. The instructions are in your browser's help pages; we do not reproduce them, because they change.
7.2 Blocking all cookies breaks sign-in and Sessions, which depend on strictly necessary technologies. Blocking third-party cookies alone generally does not.
7.3 Clearing site data also clears your recorded choice, so we will ask again next visit.
8. Do Not Track and Global Privacy Control
8.1 Do Not Track (DNT) was never finalised as a standard and has no agreed meaning, so we do not rely on it as a choice. (PostHog on the website does stop capturing when it sees DNT, but your choice in our banner is what governs.)
8.2 Global Privacy Control (GPC) is different: it is a machine-readable signal of a specific choice.
8.3 We honour GPC. If your browser sends a Global Privacy Control signal, we treat it as a refusal of all technologies that need consent, and we do not show you the banner for them.
9. Third parties and international transfers
9.1 Where a third party sets something through Lemma it is named in section 4 and in the Sub-processor List, and processes data under an Art. 28 contract or, where it acts for its own purposes, its own privacy notice.
9.2 Some providers process data outside the EEA. The safeguards — adequacy where the recipient is certified under the EU–US Data Privacy Framework, with the 2021 Standard Contractual Clauses layered as a fallback — are in section 7 of the Privacy Policy.
10. Changes and contact
10.1 We update this Policy whenever we add, remove or change a technology, and after each cookie scan. The version and effective date are at the top.
10.2 Questions or requests: privacy@getlemma.io. You can also complain to the Office of the Commissioner for Personal Data Protection — details in section 9 of the Privacy Policy.