Walnut Institute Cookie Policy

1) What Are Cookies?

Cookies are small text files stored on your device (computer, phone, tablet) when you visit a website or use an online service. Cookies help websites and apps work properly, stay secure, remember your preferences, and understand how the Services are used.

We also use similar technologies, such as:

• Local storage (data stored by your browser)
• SDKs (software components used in apps or web experiences)
• Pixels and tags (small pieces of code that measure usage or campaign performance)
• Similar identifiers used for security, analytics, and functionality

For simplicity, we refer to all of these as "cookies" in this policy.

2) First-Party vs Third-Party Cookies

• First-party cookies are set by Walnut (our domain) and are generally used for essential functions, security, and preferences.
• Third-party cookies are set by third parties when their tools or services are used within the Services (for example, payment pages, security tools, or embedded content). Whether third-party cookies are used can depend on your settings and how the Services are configured.

3) How We Use Cookies

We use cookies and similar technologies for the purposes below. Some cookies are strictly necessary and do not require consent under many laws because they are essential to provide the Services you request. Other cookies are optional and, where required by law (for example, in the EU/UK), we will ask for your consent before placing them.

A) Strictly Necessary Cookies (Essential)

These cookies are required for the Services to function. Without them, core features like logging in, navigating securely, and maintaining session integrity may not work.

Strictly necessary cookies may be used for:

• Authentication and session management (keeping you signed in and maintaining your session)
• Security and fraud prevention (helping detect suspicious activity and protect Accounts)
• Load balancing and reliability (helping route requests to keep the Services available)
• Saving your cookie preferences (remembering your consent choices)

Examples (names may vary by configuration):

• Authentication/session cookies (for example, session tokens)
• CSRF protection cookies (anti-forgery security)
• Cookie consent preference cookie (to remember what you selected)

Typical retention:

• Many are session-based (deleted when you close your browser)
• Some persist for a limited period to keep you signed in or remember choices

Legal basis (where applicable under GDPR-style laws):

• Contractual necessity and legitimate interests for security and service delivery

B) Performance and Analytics Cookies

These cookies help us understand how the Services are used so we can improve performance, usability, and reliability. They may collect information such as pages visited, features used, time on page, and interaction patterns.

Analytics cookies may be used for:

• Understanding traffic and usage trends
• Debugging, testing, and improving features and user experience
• Measuring performance (for example, page load and error rates)

Important notes:

• These cookies are optional in many jurisdictions, and where required we will request your consent before enabling them.
• Depending on configuration and your cookie settings, analytics may be aggregated or event-level.

Typical retention:

• Often persistent for a defined period (for example, days or months), depending on settings

Legal basis (where applicable under GDPR-style laws):

• Consent (where required)
• Legitimate interests may apply in limited cases where permitted, but we will use consent mechanisms when required by law

C) Functional Cookies (Preferences)

These cookies remember your choices to provide a smoother experience.

Functional cookies may be used for:

• Remembering preferences (for example, language and time zone)
• Remembering interface settings (for example, display preferences)
• Supporting user experience features that are not strictly required but are helpful

Typical retention:

• Often persistent for a defined period so preferences remain saved

Legal basis (where applicable under GDPR-style laws):

• Consent (where required)
• Contractual necessity may apply to certain preference functions closely tied to providing the Services you request

D) Targeting, Advertising, and Marketing Measurement Cookies (Where Enabled)

Walnut may use cookies or similar technologies for marketing measurement only where enabled and subject to your choices. These help understand whether a campaign or message was effective (for example, whether someone clicked a link and later signed up).

If enabled, these technologies may be used for:

• Measuring campaign performance and conversions
• Limiting repeated promotions (frequency capping)
• Understanding broad marketing effectiveness

What we do not do (by default):

• We do not sell personal information for money.
• We do not enable third-party advertisers to track you across unrelated sites unless we clearly disclose this, obtain any required consent, and provide appropriate opt-out mechanisms.

California note (CCPA/CPRA):

If we ever engage in "sharing" for cross-context behavioral advertising as defined by California law, we will provide a clear "Do Not Sell or Share My Personal Information" style opt-out mechanism and honor it as required.

Legal basis (where applicable under GDPR-style laws):

• Consent (where required)

4) Cookies and Third-Party Services We Use

Our Services use a modern web stack. Some tools are libraries or infrastructure that may use cookies as part of providing secure functionality. Below are third-party services referenced in our technical documentation and how cookies may relate to them.

A) Authentication (NextAuth.js)

We use NextAuth.js for robust authentication. Authentication typically relies on first-party cookies to:

• Keep you signed in (session cookies)
• Protect against forgery (CSRF cookies)
• Support secure sign-in flows (callback state cookies)

These cookies are generally strictly necessary because they enable Account access and secure sessions.

B) Hosting, Security, and Delivery (Vercel, and Cloudflare where used)

We may use hosting, edge delivery, and security services to run and protect the Services (for example, Vercel, and Cloudflare where configured). Depending on configuration, these providers may set or help manage cookies or similar identifiers for:

• Security (for example, bot detection and abuse prevention)
• Reliability and performance (for example, load balancing, caching behaviors)

These are typically strictly necessary for security and service delivery.

C) AI Features (OpenAI API)

We use the OpenAI API to deliver AI Features (such as an AI tutor/chat). In typical configurations, OpenAI does not set cookies in your browser through our API usage because requests are handled server-to-server. Your experience may still rely on Walnut cookies for:

• Keeping you signed in
• Maintaining session integrity while using AI Features

D) Payments (Third-Party Payment Processors)

Payments are processed by third-party payment processors. If we embed or redirect you to a payment page, the processor may place cookies or similar technologies that help:

• Process payments securely
• Prevent fraud
• Remember session state during checkout

These cookies are governed by the payment processor's policies. We encourage you to review their cookie and privacy notices when you check out.

E) File Storage and Media Delivery (S3-compatible storage, Cloudflare R2 where used)

Storage services generally do not set cookies by themselves, but if media is served through third-party domains or delivery layers, those layers may use security or performance identifiers as described above.

5) Your Choices and How to Manage Cookies

A) Cookie Consent Tools and Cookie Settings

Where required by law, we use a cookie consent banner or similar tools to let you choose whether optional cookies (such as analytics or marketing measurement where enabled) are placed on your device.

If available, you can also update your choices at any time by using a "Cookie Settings" link in the Services (for example, in the footer or within settings).

B) Browser Controls

Most browsers allow you to control cookies through settings, including the ability to:

• Delete existing cookies
• Block cookies entirely
• Block third-party cookies
• Set rules for specific sites

If you block strictly necessary cookies, parts of the Services may not work (including login and secure account access).

Helpful browser resources (paths vary by browser):

• Chrome: Settings -> Privacy and security -> Cookies and other site data
• Safari: Settings -> Privacy
• Firefox: Settings -> Privacy & Security
• Edge: Settings -> Cookies and site permissions

C) Mobile and App Controls

If you access the Services via a mobile device, you may also be able to control certain tracking technologies via your device settings (for example, limiting ad tracking or resetting advertising identifiers).

D) Withdrawing Consent

If you previously consented to optional cookies, you can withdraw that consent at any time through Cookie Settings (where available) or by adjusting your browser settings. Withdrawal of consent does not affect the lawfulness of processing before you withdrew it.

6) Do Not Track (DNT) Signals

Some browsers offer a "Do Not Track" (DNT) preference. There is no universally accepted standard for how to interpret DNT signals. For that reason, the Services do not currently respond to DNT signals in a uniform way.

Instead, we honor cookie choices you make through our cookie consent tools (where available) and through your browser or device settings.

7) Updates to This Cookie Policy

We may update this Cookie Policy to reflect changes in our practices, technology, legal requirements, or the Services. The "Last Updated" date at the top indicates when this policy was last revised. If changes are material, we may provide additional notice as required by law.

8) Contact Us

If you have questions or requests related to cookies or privacy, contact:

privacy@walnutinstitute.com